@mmnto/cli 1.72.0 → 1.73.0

package/dist/commands/spine-cert-run-corpus.d.ts

@@ -1,6 +1,13 @@
-import type { GroundTruthLabel, MinerLedgers, ResolvedPrDiff, ReviewThreadContent, Stage4VerifierDeps } from '@mmnto/totem';
+import type { GroundTruthLabel, MinerLedgers, ResolvedPrDiff, ReviewThreadContent, Stage4VerifierDeps, WindtunnelLock } from '@mmnto/totem';
+/** Local alias for the core git exec port (mirrors spine-windtunnel.ts / spine-cert-materialize.ts). */
+type SafeExecFn = typeof import('@mmnto/totem').safeExec;
 import { type ReplayArtifact } from './spine-llm-replay.js';
-import type { CertifyingCorpusProvider } from './spine-windtunnel.js';
+import type { CertifyingCorpus, CertifyingCorpusProvider } from './spine-windtunnel.js';
+export declare const PR_DIFFS_FILE = "pr-diffs.json";
+/** The cert-run answer key — produced by `derive-labels` (5d-iii), read by the run. */
+export declare const GROUND_TRUTH_FILE = "ground-truth-labels.json";
+/** The frozen held-out disposition provenance — produced by `fetch-dispositions` (5d-ii). */
+export declare const CORPUS_DISPOSITIONS_FILE = "corpus-dispositions.json";
 export interface CertRunFixtureInputs {
     split: import('@mmnto/totem').SplitArtifact;
     artifact: ReplayArtifact;
@@ -14,7 +21,20 @@ export interface CertRunFixtureInputs {
  * dynamically imported per the CLI lazy-import convention, not pulled in at
  * module load.
  */
-export declare function loadCertRunFixtures(gate1Dir: string): Promise<CertRunFixtureInputs>;
+export declare function loadCertRunFixtures(gate1Dir: string, opts?: {
+    expectedPrDiffsSha?: string;
+    skipGroundTruth?: boolean;
+}): Promise<CertRunFixtureInputs>;
+/**
+ * Build the Stage-4 verifier deps (listFiles/readFile over the frozen post-image
+ * at `asOf`) — the SHARED constructor both the certifying run and the 5d-iii
+ * deriver use, so the archived-rule exclusion (hence the scored rule set, hence
+ * the firing labelIds) is identical. With an lc clone, files resolve via
+ * `git ls-tree`/`git show` at `asOf` (a local clone — zero network); without one,
+ * Stage-4 sees no files (rules read as untested, NOT archived). Tests inject a
+ * fake `Stage4VerifierDeps` into `assembleCertifyingCorpus` directly instead.
+ */
+export declare function buildGate1Stage4Deps(lcDir: string | undefined, asOf: string, safeExec: SafeExecFn): Stage4VerifierDeps;
 export interface ReplayCorpusProviderOptions {
     /** The `.totem/spine/gate-1` dir holding the committed cert-run fixtures. */
     gate1Dir: string;
@@ -28,15 +48,30 @@ export interface ReplayCorpusProviderOptions {
     onLedgers?: (ledgers: MinerLedgers) => void;
 }
 /**
- * Build the REPLAY-mode `CertifyingCorpusProvider` the certifying run injects.
- *
- * Loads the committed cert-run fixtures (split, frozen `llm-replay.v1` artifact,
- * frozen review content, resolved-PR diffs, ground-truth labels) from the gate-1
- * dir, constructs the zero-network replay adapters (gated on the lock's L2
- * `llmReplaySha`) + a frozen review-thread source, then composes them through
- * `buildCertifyingCorpus`. fold-I ledgers are emitted (default: written to
- * `miner-ledgers.json`) for §7 observability. Throws loud if the lock lacks the
- * L2 replay hash (no safe default for an integrity gate).
+ * Assemble the REPLAY-mode `CertifyingCorpus` (rules + prDiffs + provenance) from
+ * the committed gate-1 fixtures — the SHARED path both the certifying run (via
+ * `buildReplayCorpusProvider`) and the 5d-iii label-deriver call, so the corpus
+ * they enumerate firings over is byte-identical (the answer-key labelIds the
+ * deriver mints are the ones the run looks up). The deriver passes
+ * `skipGroundTruth: true` — it PRODUCES `ground-truth-labels.json`, so it must
+ * not read it (circularity guard); the run omits the flag and loads the frozen
+ * answer key. Returns the fold-I ledgers too; the caller decides whether to emit
+ * them (the run does; the deriver discards — they belong to the run artifact).
+ */
+export declare function assembleCertifyingCorpus(opts: ReplayCorpusProviderOptions & {
+    skipGroundTruth?: boolean;
+}, lock: WindtunnelLock): Promise<{
+    corpus: CertifyingCorpus;
+    ledgers: MinerLedgers;
+}>;
+/**
+ * Build the REPLAY-mode `CertifyingCorpusProvider` the certifying run injects: a thin
+ * wrapper over `assembleCertifyingCorpus` (fixture-load + replay adapters + the
+ * `buildCertifyingCorpus` composition) that also emits the fold-I miner ledgers
+ * (default: `miner-ledgers.json`) for §7 observability. The deriver calls
+ * `assembleCertifyingCorpus` directly instead (it skips ground-truth + discards the
+ * ledgers, which belong to the run artifact).
  */
 export declare function buildReplayCorpusProvider(opts: ReplayCorpusProviderOptions): CertifyingCorpusProvider;
+export {};
 //# sourceMappingURL=spine-cert-run-corpus.d.ts.map

package/dist/commands/spine-cert-run-corpus.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"spine-cert-run-corpus.d.ts","sourceRoot":"","sources":["../../src/commands/spine-cert-run-corpus.ts"],"names":[],"mappings":"AAKA,OAAO,KAAK,EACV,gBAAgB,EAChB,YAAY,EACZ,cAAc,EACd,mBAAmB,EAGnB,kBAAkB,EAEnB,MAAM,cAAc,CAAC;AAItB,OAAO,EAAE,KAAK,cAAc,EAAwB,MAAM,uBAAuB,CAAC;AAClF,OAAO,KAAK,EAAoB,wBAAwB,EAAE,MAAM,uBAAuB,CAAC;AAiDxF,MAAM,WAAW,oBAAoB;IACnC,KAAK,EAAE,OAAO,cAAc,EAAE,aAAa,CAAC;IAC5C,QAAQ,EAAE,cAAc,CAAC;IACzB,OAAO,EAAE,mBAAmB,EAAE,CAAC;IAC/B,OAAO,EAAE,cAAc,EAAE,CAAC;IAC1B,WAAW,EAAE,GAAG,CAAC,MAAM,EAAE,gBAAgB,CAAC,CAAC;CAC5C;AAED;;;;;GAKG;AACH,wBAAsB,mBAAmB,CAAC,QAAQ,EAAE,MAAM,GAAG,OAAO,CAAC,oBAAoB,CAAC,CAoCzF;AAiBD,MAAM,WAAW,2BAA2B;IAC1C,6EAA6E;IAC7E,QAAQ,EAAE,MAAM,CAAC;IACjB,oFAAoF;IACpF,MAAM,EAAE,kBAAkB,CAAC;IAC3B,iDAAiD;IACjD,GAAG,EAAE,MAAM,CAAC;IACZ,8CAA8C;IAC9C,mBAAmB,CAAC,EAAE,OAAO,CAAC;IAC9B,4FAA4F;IAC5F,SAAS,CAAC,EAAE,CAAC,OAAO,EAAE,YAAY,KAAK,IAAI,CAAC;CAC7C;AAED;;;;;;;;;;GAUG;AACH,wBAAgB,yBAAyB,CACvC,IAAI,EAAE,2BAA2B,GAChC,wBAAwB,CA6C1B"}
+{"version":3,"file":"spine-cert-run-corpus.d.ts","sourceRoot":"","sources":["../../src/commands/spine-cert-run-corpus.ts"],"names":[],"mappings":"AAMA,OAAO,KAAK,EACV,gBAAgB,EAChB,YAAY,EACZ,cAAc,EACd,mBAAmB,EAGnB,kBAAkB,EAClB,cAAc,EACf,MAAM,cAAc,CAAC;AAEtB,wGAAwG;AACxG,KAAK,UAAU,GAAG,cAAc,cAAc,EAAE,QAAQ,CAAC;AAIzD,OAAO,EAAE,KAAK,cAAc,EAAwB,MAAM,uBAAuB,CAAC;AAClF,OAAO,KAAK,EAAE,gBAAgB,EAAE,wBAAwB,EAAE,MAAM,uBAAuB,CAAC;AAOxF,eAAO,MAAM,aAAa,kBAAkB,CAAC;AAC7C,uFAAuF;AACvF,eAAO,MAAM,iBAAiB,6BAA6B,CAAC;AAC5D,6FAA6F;AAC7F,eAAO,MAAM,wBAAwB,6BAA6B,CAAC;AAyCnE,MAAM,WAAW,oBAAoB;IACnC,KAAK,EAAE,OAAO,cAAc,EAAE,aAAa,CAAC;IAC5C,QAAQ,EAAE,cAAc,CAAC;IACzB,OAAO,EAAE,mBAAmB,EAAE,CAAC;IAC/B,OAAO,EAAE,cAAc,EAAE,CAAC;IAC1B,WAAW,EAAE,GAAG,CAAC,MAAM,EAAE,gBAAgB,CAAC,CAAC;CAC5C;AAED;;;;;GAKG;AACH,wBAAsB,mBAAmB,CACvC,QAAQ,EAAE,MAAM,EAChB,IAAI,CAAC,EAAE;IAAE,kBAAkB,CAAC,EAAE,MAAM,CAAC;IAAC,eAAe,CAAC,EAAE,OAAO,CAAA;CAAE,GAChE,OAAO,CAAC,oBAAoB,CAAC,CAoE/B;AAED;;;;;;;;GAQG;AACH,wBAAgB,oBAAoB,CAClC,KAAK,EAAE,MAAM,GAAG,SAAS,EACzB,IAAI,EAAE,MAAM,EACZ,QAAQ,EAAE,UAAU,GACnB,kBAAkB,CA6BpB;AAiBD,MAAM,WAAW,2BAA2B;IAC1C,6EAA6E;IAC7E,QAAQ,EAAE,MAAM,CAAC;IACjB,oFAAoF;IACpF,MAAM,EAAE,kBAAkB,CAAC;IAC3B,iDAAiD;IACjD,GAAG,EAAE,MAAM,CAAC;IACZ,8CAA8C;IAC9C,mBAAmB,CAAC,EAAE,OAAO,CAAC;IAC9B,4FAA4F;IAC5F,SAAS,CAAC,EAAE,CAAC,OAAO,EAAE,YAAY,KAAK,IAAI,CAAC;CAC7C;AAED;;;;;;;;;;GAUG;AACH,wBAAsB,wBAAwB,CAC5C,IAAI,EAAE,2BAA2B,GAAG;IAAE,eAAe,CAAC,EAAE,OAAO,CAAA;CAAE,EACjE,IAAI,EAAE,cAAc,GACnB,OAAO,CAAC;IAAE,MAAM,EAAE,gBAAgB,CAAC;IAAC,OAAO,EAAE,YAAY,CAAA;CAAE,CAAC,CA8C9D;AAED;;;;;;;GAOG;AACH,wBAAgB,yBAAyB,CACvC,IAAI,EAAE,2BAA2B,GAChC,wBAAwB,CAkB1B"}

package/dist/commands/spine-cert-run-corpus.js

@@ -1,3 +1,4 @@
+import { createHash } from 'node:crypto';
 import * as fs from 'node:fs';
 import * as path from 'node:path';
 import { z } from 'zod';
@@ -8,8 +9,11 @@ import { ReplayArtifactSchema } from './spine-llm-replay.js';
 const SPLIT_FILE = 'split.json';
 const REPLAY_FILE = 'llm-replay.v1.json';
 const CONTENT_FILE = 'review-content.json';
-const PR_DIFFS_FILE = 'pr-diffs.json';
-const GROUND_TRUTH_FILE = 'ground-truth-labels.json';
+export const PR_DIFFS_FILE = 'pr-diffs.json';
+/** The cert-run answer key — produced by `derive-labels` (5d-iii), read by the run. */
+export const GROUND_TRUTH_FILE = 'ground-truth-labels.json';
+/** The frozen held-out disposition provenance — produced by `fetch-dispositions` (5d-ii). */
+export const CORPUS_DISPOSITIONS_FILE = 'corpus-dispositions.json';
 const LEDGERS_FILE = 'miner-ledgers.json';
 // ─── Fixture schemas (the committed cert-run inputs) ──
 const ReviewThreadContentSchema = z.object({
@@ -48,16 +52,17 @@ function frozenSourceFrom(contents) {
  * dynamically imported per the CLI lazy-import convention, not pulled in at
  * module load.
  */
-export async function loadCertRunFixtures(gate1Dir) {
+export async function loadCertRunFixtures(gate1Dir, opts) {
     const { SplitArtifactSchema, TotemError } = await import('@mmnto/totem');
-    const loadJson = (file) => {
-        let raw;
+    const readRaw = (file) => {
         try {
-            raw = fs.readFileSync(file, 'utf-8');
+            return fs.readFileSync(file, 'utf-8');
         }
         catch (err) {
             throw new TotemError('CONFIG_INVALID', `Cert-run fixture missing: ${file}`, 'Ensure the gate-1 fixture set exists and is readable.', err);
         }
+    };
+    const parseJson = (raw, file) => {
         try {
             return JSON.parse(raw);
         }
@@ -65,16 +70,73 @@ export async function loadCertRunFixtures(gate1Dir) {
             throw new TotemError('CONFIG_INVALID', `Cert-run fixture is not valid JSON (${file})`, 'Re-freeze the gate-1 fixtures with `spine windtunnel record`.', err);
         }
     };
+    const loadJson = (file) => parseJson(readRaw(file), file);
     const split = SplitArtifactSchema.parse(loadJson(path.join(gate1Dir, SPLIT_FILE)));
     const artifact = ReplayArtifactSchema.parse(loadJson(path.join(gate1Dir, REPLAY_FILE)));
     const content = z
         .array(ReviewThreadContentSchema)
         .parse(loadJson(path.join(gate1Dir, CONTENT_FILE)));
-    const prDiffs = z.array(ResolvedPrDiffSchema).parse(loadJson(path.join(gate1Dir, PR_DIFFS_FILE)));
+    // #2225 (#709 fold-2): verify-then-parse the SCORING source on a SINGLE read — the
+    // digest must cover the exact bytes that get parsed + scored, not a separate read
+    // (CR: no check/use split). CRLF→LF normalized to match the producer's LF-stamped
+    // digest. The absent-from-lock case is the caller's precondition (it omits the sha).
+    const prDiffsFile = path.join(gate1Dir, PR_DIFFS_FILE);
+    const prDiffsRaw = readRaw(prDiffsFile);
+    if (opts?.expectedPrDiffsSha !== undefined) {
+        const actual = createHash('sha256')
+            .update(prDiffsRaw.replace(/\r\n/g, '\n'), 'utf-8')
+            .digest('hex');
+        if (actual !== opts.expectedPrDiffsSha) {
+            throw new TotemError('CONFIG_INVALID', `Certifying run: pr-diffs.json integrity FAILED — expected ${opts.expectedPrDiffsSha}, got ` +
+                `${actual} (the frozen scoring corpus was tampered or re-serialized).`, 'Restore the frozen pr-diffs.json or re-materialize the cert corpus.');
+        }
+    }
+    const prDiffs = z.array(ResolvedPrDiffSchema).parse(parseJson(prDiffsRaw, prDiffsFile));
+    // 5d-iii circularity guard: the label-deriver reuses this loader to enumerate
+    // firings byte-identically to the run, but it PRODUCES ground-truth-labels.json
+    // — so it must NOT read it (the file may not yet exist on a first derive, and
+    // reading it would make the deriver depend on its own output). `skipGroundTruth`
+    // returns an empty map; the run omits the flag and loads the frozen answer key.
+    if (opts?.skipGroundTruth) {
+        return { split, artifact, content, prDiffs, groundTruth: new Map() };
+    }
     const gtRecord = GroundTruthSchema.parse(loadJson(path.join(gate1Dir, GROUND_TRUTH_FILE)));
     const groundTruth = new Map(Object.entries(gtRecord));
     return { split, artifact, content, prDiffs, groundTruth };
 }
+/**
+ * Build the Stage-4 verifier deps (listFiles/readFile over the frozen post-image
+ * at `asOf`) — the SHARED constructor both the certifying run and the 5d-iii
+ * deriver use, so the archived-rule exclusion (hence the scored rule set, hence
+ * the firing labelIds) is identical. With an lc clone, files resolve via
+ * `git ls-tree`/`git show` at `asOf` (a local clone — zero network); without one,
+ * Stage-4 sees no files (rules read as untested, NOT archived). Tests inject a
+ * fake `Stage4VerifierDeps` into `assembleCertifyingCorpus` directly instead.
+ */
+export function buildGate1Stage4Deps(lcDir, asOf, safeExec) {
+    if (lcDir) {
+        return {
+            // The `--` separator keeps the revision unambiguous from any path args and blocks
+            // arg injection (CR coding guideline) — this shared path decides which files
+            // Stage-4 sees for BOTH the run and the deriver, so rev/path ambiguity here would
+            // shift archived-rule decisions and the derived labels.
+            listFiles: async () => safeExec('git', ['ls-tree', '-r', '--name-only', asOf, '--'], { cwd: lcDir })
+                .split('\n')
+                .filter(Boolean),
+            readFile: async (f) => safeExec('git', ['show', `${asOf}:${f.replace(/\\/g, '/')}`, '--'], { cwd: lcDir }),
+            workingDirectory: lcDir,
+        };
+    }
+    return {
+        // No lc clone → Stage-4 sees no files (rules read as 'no-matches' / untested,
+        // NOT archived) — the wind-tunnel firing/scoring still runs.
+        listFiles: async () => [],
+        readFile: async (f) => {
+            const { TotemError } = await import('@mmnto/totem');
+            throw new TotemError('CONFIG_INVALID', `Cert run: no lc clone (--lc-dir) — cannot read ${f} for Stage-4.`, 'Provide the lc clone via --lc-dir or the TOTEM_LC_DIR environment variable.');
+        },
+    };
+}
 /** Derive the SplitLedger from the loaded split + the lock's resolved corpus. */
 function splitLedgerFrom(split, lock) {
     return {
@@ -87,38 +149,60 @@ function splitLedgerFrom(split, lock) {
     };
 }
 /**
- * Build the REPLAY-mode `CertifyingCorpusProvider` the certifying run injects.
- *
- * Loads the committed cert-run fixtures (split, frozen `llm-replay.v1` artifact,
- * frozen review content, resolved-PR diffs, ground-truth labels) from the gate-1
- * dir, constructs the zero-network replay adapters (gated on the lock's L2
- * `llmReplaySha`) + a frozen review-thread source, then composes them through
- * `buildCertifyingCorpus`. fold-I ledgers are emitted (default: written to
- * `miner-ledgers.json`) for §7 observability. Throws loud if the lock lacks the
- * L2 replay hash (no safe default for an integrity gate).
+ * Assemble the REPLAY-mode `CertifyingCorpus` (rules + prDiffs + provenance) from
+ * the committed gate-1 fixtures — the SHARED path both the certifying run (via
+ * `buildReplayCorpusProvider`) and the 5d-iii label-deriver call, so the corpus
+ * they enumerate firings over is byte-identical (the answer-key labelIds the
+ * deriver mints are the ones the run looks up). The deriver passes
+ * `skipGroundTruth: true` — it PRODUCES `ground-truth-labels.json`, so it must
+ * not read it (circularity guard); the run omits the flag and loads the frozen
+ * answer key. Returns the fold-I ledgers too; the caller decides whether to emit
+ * them (the run does; the deriver discards — they belong to the run artifact).
+ */
+export async function assembleCertifyingCorpus(opts, lock) {
+    const { TotemError } = await import('@mmnto/totem');
+    const expectedHash = lock.controls.integrity.llmReplaySha;
+    if (!expectedHash) {
+        throw new TotemError('CONFIG_INVALID', 'Certifying run: lock is missing controls.integrity.llmReplaySha (L2) — the frozen ' +
+            'llm-replay fixture cannot be integrity-checked.', 'Re-freeze the lock after a `record` run.');
+    }
+    // #2225 (#709 fold-2): hash-bind the SCORING source. `pr-diffs.json` is otherwise
+    // unprotected — `fixtureSha` covers only the control dirs — so a silent mutation of
+    // any row (advisory-window OR control) would corrupt the answer key while the
+    // control-dir gate stays green. The absent-from-lock case is a lock precondition
+    // (checked here); `loadCertRunFixtures` verifies the digest on the SAME read it
+    // parses — no check/use split (CR). Fail loud (strategy ruled: verify at freeze AND run).
+    const expectedPrDiffsSha = lock.controls.integrity.prDiffsSha;
+    if (!expectedPrDiffsSha) {
+        throw new TotemError('CONFIG_INVALID', 'Certifying run: lock is missing controls.integrity.prDiffsSha (#709 fold-2) — the ' +
+            'pr-diffs.json scoring source cannot be integrity-checked.', 'Re-materialize the cert corpus with `spine windtunnel materialize`.');
+    }
+    const { split, artifact, content, prDiffs, groundTruth } = await loadCertRunFixtures(opts.gate1Dir, { expectedPrDiffsSha, skipGroundTruth: opts.skipGroundTruth });
+    const { extractor, classifier } = buildReplayAdapters(artifact, expectedHash);
+    return buildCertifyingCorpus({
+        split,
+        splitLedger: splitLedgerFrom(split, lock),
+        source: frozenSourceFrom(content),
+        extractor,
+        classifier,
+        seedClassesProvided: opts.seedClassesProvided ?? false,
+        stage4: opts.stage4,
+        now: opts.now,
+        prDiffs,
+        groundTruth,
+    });
+}
+/**
+ * Build the REPLAY-mode `CertifyingCorpusProvider` the certifying run injects: a thin
+ * wrapper over `assembleCertifyingCorpus` (fixture-load + replay adapters + the
+ * `buildCertifyingCorpus` composition) that also emits the fold-I miner ledgers
+ * (default: `miner-ledgers.json`) for §7 observability. The deriver calls
+ * `assembleCertifyingCorpus` directly instead (it skips ground-truth + discards the
+ * ledgers, which belong to the run artifact).
  */
 export function buildReplayCorpusProvider(opts) {
     return async (lock) => {
-        const { TotemError } = await import('@mmnto/totem');
-        const expectedHash = lock.controls.integrity.llmReplaySha;
-        if (!expectedHash) {
-            throw new TotemError('CONFIG_INVALID', 'Certifying run: lock is missing controls.integrity.llmReplaySha (L2) — the frozen ' +
-                'llm-replay fixture cannot be integrity-checked.', 'Re-freeze the lock after a `record` run.');
-        }
-        const { split, artifact, content, prDiffs, groundTruth } = await loadCertRunFixtures(opts.gate1Dir);
-        const { extractor, classifier } = buildReplayAdapters(artifact, expectedHash);
-        const { corpus, ledgers } = await buildCertifyingCorpus({
-            split,
-            splitLedger: splitLedgerFrom(split, lock),
-            source: frozenSourceFrom(content),
-            extractor,
-            classifier,
-            seedClassesProvided: opts.seedClassesProvided ?? false,
-            stage4: opts.stage4,
-            now: opts.now,
-            prDiffs,
-            groundTruth,
-        });
+        const { corpus, ledgers } = await assembleCertifyingCorpus(opts, lock);
         // fold-I (§7): emit the miner ledgers, observable beside the cert-run report.
         if (opts.onLedgers) {
             opts.onLedgers(ledgers);

package/dist/commands/spine-cert-run-corpus.js.map

@@ -1 +1 @@
-{"version":3,"file":"spine-cert-run-corpus.js","sourceRoot":"","sources":["../../src/commands/spine-cert-run-corpus.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,MAAM,SAAS,CAAC;AAC9B,OAAO,KAAK,IAAI,MAAM,WAAW,CAAC;AAElC,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAaxB,OAAO,EAAE,qBAAqB,EAAE,MAAM,wBAAwB,CAAC;AAC/D,OAAO,EAAE,mBAAmB,EAAE,MAAM,wBAAwB,CAAC;AAC7D,OAAO,EAAuB,oBAAoB,EAAE,MAAM,uBAAuB,CAAC;AAGlF,wDAAwD;AAExD,MAAM,UAAU,GAAG,YAAY,CAAC;AAChC,MAAM,WAAW,GAAG,oBAAoB,CAAC;AACzC,MAAM,YAAY,GAAG,qBAAqB,CAAC;AAC3C,MAAM,aAAa,GAAG,eAAe,CAAC;AACtC,MAAM,iBAAiB,GAAG,0BAA0B,CAAC;AACrD,MAAM,YAAY,GAAG,oBAAoB,CAAC;AAE1C,yDAAyD;AAEzD,MAAM,yBAAyB,GAAG,CAAC,CAAC,MAAM,CAAC;IACzC,EAAE,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,QAAQ,EAAE;IAC/B,cAAc,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,KAAK,CAAC,gBAAgB,CAAC;IAClD,OAAO,EAAE,CAAC,CAAC,KAAK,CACd,CAAC,CAAC,MAAM,CAAC;QACP,IAAI,EAAE,CAAC,CAAC,MAAM,EAAE;QAChB,QAAQ,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,CAAC,EAAE,MAAM,EAAE,CAAC,CAAC,MAAM,EAAE,EAAE,IAAI,EAAE,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC;QACrE,UAAU,EAAE,CAAC,CAAC,OAAO,EAAE;QACvB,UAAU,EAAE,CAAC,CAAC,OAAO,EAAE;KACxB,CAAC,CACH;CACF,CAAC,CAAC;AAEH,MAAM,oBAAoB,GAAG,CAAC,CAAC,MAAM,CAAC;IACpC,EAAE,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,QAAQ,EAAE;IAC/B,IAAI,EAAE,CAAC,CAAC,MAAM,EAAE;IAChB,WAAW,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC,QAAQ,EAAE,UAAU,EAAE,UAAU,CAAC,CAAC;IACvD,YAAY,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;CACpC,CAAC,CAAC;AAEH,wBAAwB;AACxB,MAAM,iBAAiB,GAAG,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,IAAI,EAAE,IAAI,CAAC,CAAC,CAAC,CAAC;AAEzD,oFAAoF;AACpF,SAAS,gBAAgB,CAAC,QAA+B;IACvD,MAAM,IAAI,GAAG,IAAI,GAAG,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC;IACrD,OAAO;QACL,KAAK,CAAC,KAAK,CAAC,EAAU;YACpB,MAAM,OAAO,GAAG,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;YAC7B,OAAO,OAAO;gBACZ,CAAC,CAAC,EAAE,IAAI,EAAE,IAAa,EAAE,OAAO,EAAE;gBAClC,CAAC,CAAC,EAAE,IAAI,EAAE,aAAsB,EAAE,MAAM,EAAE,mCAAmC,EAAE,EAAE,EAAE,CAAC;QACxF,CAAC;KACF,CAAC;AACJ,CAAC;AAUD;;;;;GAKG;AACH,MAAM,CAAC,KAAK,UAAU,mBAAmB,CAAC,QAAgB;IACxD,MAAM,EAAE,mBAAmB,EAAE,UAAU,EAAE,GAAG,MAAM,MAAM,CAAC,cAAc,CAAC,CAAC;IAEzE,MAAM,QAAQ,GAAG,CAAC,IAAY,EAAW,EAAE;QACzC,IAAI,GAAW,CAAC;QAChB,IAAI,CAAC;YACH,GAAG,GAAG,EAAE,CAAC,YAAY,CAAC,IAAI,EAAE,OAAO,CAAC,CAAC;QACvC,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,MAAM,IAAI,UAAU,CAClB,gBAAgB,EAChB,6BAA6B,IAAI,EAAE,EACnC,uDAAuD,EACvD,GAAG,CACJ,CAAC;QACJ,CAAC;QACD,IAAI,CAAC;YACH,OAAO,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;QACzB,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,MAAM,IAAI,UAAU,CAClB,gBAAgB,EAChB,uCAAuC,IAAI,GAAG,EAC9C,+DAA+D,EAC/D,GAAG,CACJ,CAAC;QACJ,CAAC;IACH,CAAC,CAAC;IAEF,MAAM,KAAK,GAAG,mBAAmB,CAAC,KAAK,CAAC,QAAQ,CAAC,IAAI,CAAC,IAAI,CAAC,QAAQ,EAAE,UAAU,CAAC,CAAC,CAAC,CAAC;IACnF,MAAM,QAAQ,GAAG,oBAAoB,CAAC,KAAK,CAAC,QAAQ,CAAC,IAAI,CAAC,IAAI,CAAC,QAAQ,EAAE,WAAW,CAAC,CAAC,CAAC,CAAC;IACxF,MAAM,OAAO,GAAG,CAAC;SACd,KAAK,CAAC,yBAAyB,CAAC;SAChC,KAAK,CAAC,QAAQ,CAAC,IAAI,CAAC,IAAI,CAAC,QAAQ,EAAE,YAAY,CAAC,CAAC,CAAC,CAAC;IACtD,MAAM,OAAO,GAAG,CAAC,CAAC,KAAK,CAAC,oBAAoB,CAAC,CAAC,KAAK,CAAC,QAAQ,CAAC,IAAI,CAAC,IAAI,CAAC,QAAQ,EAAE,aAAa,CAAC,CAAC,CAAC,CAAC;IAClG,MAAM,QAAQ,GAAG,iBAAiB,CAAC,KAAK,CAAC,QAAQ,CAAC,IAAI,CAAC,IAAI,CAAC,QAAQ,EAAE,iBAAiB,CAAC,CAAC,CAAC,CAAC;IAC3F,MAAM,WAAW,GAAG,IAAI,GAAG,CAA2B,MAAM,CAAC,OAAO,CAAC,QAAQ,CAAC,CAAC,CAAC;IAChF,OAAO,EAAE,KAAK,EAAE,QAAQ,EAAE,OAAO,EAAE,OAAO,EAAE,WAAW,EAAE,CAAC;AAC5D,CAAC;AAED,iFAAiF;AACjF,SAAS,eAAe,CACtB,KAA2C,EAC3C,IAAoB;IAEpB,OAAO;QACL,KAAK;QACL,MAAM,EAAE,IAAI,CAAC,MAAM,CAAC,WAAW,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QAChD,kBAAkB,EAAE,IAAI,CAAC,MAAM,CAAC,WAAW,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;YACtD,EAAE,EAAE,CAAC,CAAC,EAAE;YACR,WAAW,EAAE,CAAC,CAAC,WAAW;SAC3B,CAAC,CAAC;KACJ,CAAC;AACJ,CAAC;AAeD;;;;;;;;;;GAUG;AACH,MAAM,UAAU,yBAAyB,CACvC,IAAiC;IAEjC,OAAO,KAAK,EAAE,IAAoB,EAA6B,EAAE;QAC/D,MAAM,EAAE,UAAU,EAAE,GAAG,MAAM,MAAM,CAAC,cAAc,CAAC,CAAC;QACpD,MAAM,YAAY,GAAG,IAAI,CAAC,QAAQ,CAAC,SAAS,CAAC,YAAY,CAAC;QAC1D,IAAI,CAAC,YAAY,EAAE,CAAC;YAClB,MAAM,IAAI,UAAU,CAClB,gBAAgB,EAChB,oFAAoF;gBAClF,iDAAiD,EACnD,0CAA0C,CAC3C,CAAC;QACJ,CAAC;QAED,MAAM,EAAE,KAAK,EAAE,QAAQ,EAAE,OAAO,EAAE,OAAO,EAAE,WAAW,EAAE,GAAG,MAAM,mBAAmB,CAClF,IAAI,CAAC,QAAQ,CACd,CAAC;QACF,MAAM,EAAE,SAAS,EAAE,UAAU,EAAE,GAAG,mBAAmB,CAAC,QAAQ,EAAE,YAAY,CAAC,CAAC;QAE9E,MAAM,EAAE,MAAM,EAAE,OAAO,EAAE,GAAG,MAAM,qBAAqB,CAAC;YACtD,KAAK;YACL,WAAW,EAAE,eAAe,CAAC,KAAK,EAAE,IAAI,CAAC;YACzC,MAAM,EAAE,gBAAgB,CAAC,OAAO,CAAC;YACjC,SAAS;YACT,UAAU;YACV,mBAAmB,EAAE,IAAI,CAAC,mBAAmB,IAAI,KAAK;YACtD,MAAM,EAAE,IAAI,CAAC,MAAM;YACnB,GAAG,EAAE,IAAI,CAAC,GAAG;YACb,OAAO;YACP,WAAW;SACZ,CAAC,CAAC;QAEH,8EAA8E;QAC9E,IAAI,IAAI,CAAC,SAAS,EAAE,CAAC;YACnB,IAAI,CAAC,SAAS,CAAC,OAAO,CAAC,CAAC;QAC1B,CAAC;aAAM,CAAC;YACN,EAAE,CAAC,SAAS,CAAC,IAAI,CAAC,QAAQ,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;YACjD,EAAE,CAAC,aAAa,CACd,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,QAAQ,EAAE,YAAY,CAAC,EACtC,IAAI,CAAC,SAAS,CAAC,OAAO,EAAE,IAAI,EAAE,CAAC,CAAC,EAChC,OAAO,CACR,CAAC;QACJ,CAAC;QAED,OAAO,MAAM,CAAC;IAChB,CAAC,CAAC;AACJ,CAAC"}
+{"version":3,"file":"spine-cert-run-corpus.js","sourceRoot":"","sources":["../../src/commands/spine-cert-run-corpus.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AACzC,OAAO,KAAK,EAAE,MAAM,SAAS,CAAC;AAC9B,OAAO,KAAK,IAAI,MAAM,WAAW,CAAC;AAElC,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAgBxB,OAAO,EAAE,qBAAqB,EAAE,MAAM,wBAAwB,CAAC;AAC/D,OAAO,EAAE,mBAAmB,EAAE,MAAM,wBAAwB,CAAC;AAC7D,OAAO,EAAuB,oBAAoB,EAAE,MAAM,uBAAuB,CAAC;AAGlF,wDAAwD;AAExD,MAAM,UAAU,GAAG,YAAY,CAAC;AAChC,MAAM,WAAW,GAAG,oBAAoB,CAAC;AACzC,MAAM,YAAY,GAAG,qBAAqB,CAAC;AAC3C,MAAM,CAAC,MAAM,aAAa,GAAG,eAAe,CAAC;AAC7C,uFAAuF;AACvF,MAAM,CAAC,MAAM,iBAAiB,GAAG,0BAA0B,CAAC;AAC5D,6FAA6F;AAC7F,MAAM,CAAC,MAAM,wBAAwB,GAAG,0BAA0B,CAAC;AACnE,MAAM,YAAY,GAAG,oBAAoB,CAAC;AAE1C,yDAAyD;AAEzD,MAAM,yBAAyB,GAAG,CAAC,CAAC,MAAM,CAAC;IACzC,EAAE,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,QAAQ,EAAE;IAC/B,cAAc,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,KAAK,CAAC,gBAAgB,CAAC;IAClD,OAAO,EAAE,CAAC,CAAC,KAAK,CACd,CAAC,CAAC,MAAM,CAAC;QACP,IAAI,EAAE,CAAC,CAAC,MAAM,EAAE;QAChB,QAAQ,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,CAAC,EAAE,MAAM,EAAE,CAAC,CAAC,MAAM,EAAE,EAAE,IAAI,EAAE,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC;QACrE,UAAU,EAAE,CAAC,CAAC,OAAO,EAAE;QACvB,UAAU,EAAE,CAAC,CAAC,OAAO,EAAE;KACxB,CAAC,CACH;CACF,CAAC,CAAC;AAEH,MAAM,oBAAoB,GAAG,CAAC,CAAC,MAAM,CAAC;IACpC,EAAE,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,QAAQ,EAAE;IAC/B,IAAI,EAAE,CAAC,CAAC,MAAM,EAAE;IAChB,WAAW,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC,QAAQ,EAAE,UAAU,EAAE,UAAU,CAAC,CAAC;IACvD,YAAY,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;CACpC,CAAC,CAAC;AAEH,wBAAwB;AACxB,MAAM,iBAAiB,GAAG,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,IAAI,EAAE,IAAI,CAAC,CAAC,CAAC,CAAC;AAEzD,oFAAoF;AACpF,SAAS,gBAAgB,CAAC,QAA+B;IACvD,MAAM,IAAI,GAAG,IAAI,GAAG,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC;IACrD,OAAO;QACL,KAAK,CAAC,KAAK,CAAC,EAAU;YACpB,MAAM,OAAO,GAAG,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;YAC7B,OAAO,OAAO;gBACZ,CAAC,CAAC,EAAE,IAAI,EAAE,IAAa,EAAE,OAAO,EAAE;gBAClC,CAAC,CAAC,EAAE,IAAI,EAAE,aAAsB,EAAE,MAAM,EAAE,mCAAmC,EAAE,EAAE,EAAE,CAAC;QACxF,CAAC;KACF,CAAC;AACJ,CAAC;AAUD;;;;;GAKG;AACH,MAAM,CAAC,KAAK,UAAU,mBAAmB,CACvC,QAAgB,EAChB,IAAiE;IAEjE,MAAM,EAAE,mBAAmB,EAAE,UAAU,EAAE,GAAG,MAAM,MAAM,CAAC,cAAc,CAAC,CAAC;IAEzE,MAAM,OAAO,GAAG,CAAC,IAAY,EAAU,EAAE;QACvC,IAAI,CAAC;YACH,OAAO,EAAE,CAAC,YAAY,CAAC,IAAI,EAAE,OAAO,CAAC,CAAC;QACxC,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,MAAM,IAAI,UAAU,CAClB,gBAAgB,EAChB,6BAA6B,IAAI,EAAE,EACnC,uDAAuD,EACvD,GAAG,CACJ,CAAC;QACJ,CAAC;IACH,CAAC,CAAC;IACF,MAAM,SAAS,GAAG,CAAC,GAAW,EAAE,IAAY,EAAW,EAAE;QACvD,IAAI,CAAC;YACH,OAAO,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;QACzB,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,MAAM,IAAI,UAAU,CAClB,gBAAgB,EAChB,uCAAuC,IAAI,GAAG,EAC9C,+DAA+D,EAC/D,GAAG,CACJ,CAAC;QACJ,CAAC;IACH,CAAC,CAAC;IACF,MAAM,QAAQ,GAAG,CAAC,IAAY,EAAW,EAAE,CAAC,SAAS,CAAC,OAAO,CAAC,IAAI,CAAC,EAAE,IAAI,CAAC,CAAC;IAE3E,MAAM,KAAK,GAAG,mBAAmB,CAAC,KAAK,CAAC,QAAQ,CAAC,IAAI,CAAC,IAAI,CAAC,QAAQ,EAAE,UAAU,CAAC,CAAC,CAAC,CAAC;IACnF,MAAM,QAAQ,GAAG,oBAAoB,CAAC,KAAK,CAAC,QAAQ,CAAC,IAAI,CAAC,IAAI,CAAC,QAAQ,EAAE,WAAW,CAAC,CAAC,CAAC,CAAC;IACxF,MAAM,OAAO,GAAG,CAAC;SACd,KAAK,CAAC,yBAAyB,CAAC;SAChC,KAAK,CAAC,QAAQ,CAAC,IAAI,CAAC,IAAI,CAAC,QAAQ,EAAE,YAAY,CAAC,CAAC,CAAC,CAAC;IAEtD,mFAAmF;IACnF,kFAAkF;IAClF,kFAAkF;IAClF,qFAAqF;IACrF,MAAM,WAAW,GAAG,IAAI,CAAC,IAAI,CAAC,QAAQ,EAAE,aAAa,CAAC,CAAC;IACvD,MAAM,UAAU,GAAG,OAAO,CAAC,WAAW,CAAC,CAAC;IACxC,IAAI,IAAI,EAAE,kBAAkB,KAAK,SAAS,EAAE,CAAC;QAC3C,MAAM,MAAM,GAAG,UAAU,CAAC,QAAQ,CAAC;aAChC,MAAM,CAAC,UAAU,CAAC,OAAO,CAAC,OAAO,EAAE,IAAI,CAAC,EAAE,OAAO,CAAC;aAClD,MAAM,CAAC,KAAK,CAAC,CAAC;QACjB,IAAI,MAAM,KAAK,IAAI,CAAC,kBAAkB,EAAE,CAAC;YACvC,MAAM,IAAI,UAAU,CAClB,gBAAgB,EAChB,6DAA6D,IAAI,CAAC,kBAAkB,QAAQ;gBAC1F,GAAG,MAAM,6DAA6D,EACxE,qEAAqE,CACtE,CAAC;QACJ,CAAC;IACH,CAAC;IACD,MAAM,OAAO,GAAG,CAAC,CAAC,KAAK,CAAC,oBAAoB,CAAC,CAAC,KAAK,CAAC,SAAS,CAAC,UAAU,EAAE,WAAW,CAAC,CAAC,CAAC;IAExF,8EAA8E;IAC9E,gFAAgF;IAChF,8EAA8E;IAC9E,iFAAiF;IACjF,gFAAgF;IAChF,IAAI,IAAI,EAAE,eAAe,EAAE,CAAC;QAC1B,OAAO,EAAE,KAAK,EAAE,QAAQ,EAAE,OAAO,EAAE,OAAO,EAAE,WAAW,EAAE,IAAI,GAAG,EAA4B,EAAE,CAAC;IACjG,CAAC;IAED,MAAM,QAAQ,GAAG,iBAAiB,CAAC,KAAK,CAAC,QAAQ,CAAC,IAAI,CAAC,IAAI,CAAC,QAAQ,EAAE,iBAAiB,CAAC,CAAC,CAAC,CAAC;IAC3F,MAAM,WAAW,GAAG,IAAI,GAAG,CAA2B,MAAM,CAAC,OAAO,CAAC,QAAQ,CAAC,CAAC,CAAC;IAChF,OAAO,EAAE,KAAK,EAAE,QAAQ,EAAE,OAAO,EAAE,OAAO,EAAE,WAAW,EAAE,CAAC;AAC5D,CAAC;AAED;;;;;;;;GAQG;AACH,MAAM,UAAU,oBAAoB,CAClC,KAAyB,EACzB,IAAY,EACZ,QAAoB;IAEpB,IAAI,KAAK,EAAE,CAAC;QACV,OAAO;YACL,kFAAkF;YAClF,6EAA6E;YAC7E,kFAAkF;YAClF,wDAAwD;YACxD,SAAS,EAAE,KAAK,IAAI,EAAE,CACpB,QAAQ,CAAC,KAAK,EAAE,CAAC,SAAS,EAAE,IAAI,EAAE,aAAa,EAAE,IAAI,EAAE,IAAI,CAAC,EAAE,EAAE,GAAG,EAAE,KAAK,EAAE,CAAC;iBAC1E,KAAK,CAAC,IAAI,CAAC;iBACX,MAAM,CAAC,OAAO,CAAC;YACpB,QAAQ,EAAE,KAAK,EAAE,CAAS,EAAE,EAAE,CAC5B,QAAQ,CAAC,KAAK,EAAE,CAAC,MAAM,EAAE,GAAG,IAAI,IAAI,CAAC,CAAC,OAAO,CAAC,KAAK,EAAE,GAAG,CAAC,EAAE,EAAE,IAAI,CAAC,EAAE,EAAE,GAAG,EAAE,KAAK,EAAE,CAAC;YACrF,gBAAgB,EAAE,KAAK;SACxB,CAAC;IACJ,CAAC;IACD,OAAO;QACL,8EAA8E;QAC9E,6DAA6D;QAC7D,SAAS,EAAE,KAAK,IAAI,EAAE,CAAC,EAAE;QACzB,QAAQ,EAAE,KAAK,EAAE,CAAS,EAAE,EAAE;YAC5B,MAAM,EAAE,UAAU,EAAE,GAAG,MAAM,MAAM,CAAC,cAAc,CAAC,CAAC;YACpD,MAAM,IAAI,UAAU,CAClB,gBAAgB,EAChB,kDAAkD,CAAC,eAAe,EAClE,6EAA6E,CAC9E,CAAC;QACJ,CAAC;KACF,CAAC;AACJ,CAAC;AAED,iFAAiF;AACjF,SAAS,eAAe,CACtB,KAA2C,EAC3C,IAAoB;IAEpB,OAAO;QACL,KAAK;QACL,MAAM,EAAE,IAAI,CAAC,MAAM,CAAC,WAAW,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QAChD,kBAAkB,EAAE,IAAI,CAAC,MAAM,CAAC,WAAW,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;YACtD,EAAE,EAAE,CAAC,CAAC,EAAE;YACR,WAAW,EAAE,CAAC,CAAC,WAAW;SAC3B,CAAC,CAAC;KACJ,CAAC;AACJ,CAAC;AAeD;;;;;;;;;;GAUG;AACH,MAAM,CAAC,KAAK,UAAU,wBAAwB,CAC5C,IAAiE,EACjE,IAAoB;IAEpB,MAAM,EAAE,UAAU,EAAE,GAAG,MAAM,MAAM,CAAC,cAAc,CAAC,CAAC;IACpD,MAAM,YAAY,GAAG,IAAI,CAAC,QAAQ,CAAC,SAAS,CAAC,YAAY,CAAC;IAC1D,IAAI,CAAC,YAAY,EAAE,CAAC;QAClB,MAAM,IAAI,UAAU,CAClB,gBAAgB,EAChB,oFAAoF;YAClF,iDAAiD,EACnD,0CAA0C,CAC3C,CAAC;IACJ,CAAC;IAED,kFAAkF;IAClF,oFAAoF;IACpF,8EAA8E;IAC9E,iFAAiF;IACjF,gFAAgF;IAChF,0FAA0F;IAC1F,MAAM,kBAAkB,GAAG,IAAI,CAAC,QAAQ,CAAC,SAAS,CAAC,UAAU,CAAC;IAC9D,IAAI,CAAC,kBAAkB,EAAE,CAAC;QACxB,MAAM,IAAI,UAAU,CAClB,gBAAgB,EAChB,oFAAoF;YAClF,2DAA2D,EAC7D,qEAAqE,CACtE,CAAC;IACJ,CAAC;IAED,MAAM,EAAE,KAAK,EAAE,QAAQ,EAAE,OAAO,EAAE,OAAO,EAAE,WAAW,EAAE,GAAG,MAAM,mBAAmB,CAClF,IAAI,CAAC,QAAQ,EACb,EAAE,kBAAkB,EAAE,eAAe,EAAE,IAAI,CAAC,eAAe,EAAE,CAC9D,CAAC;IACF,MAAM,EAAE,SAAS,EAAE,UAAU,EAAE,GAAG,mBAAmB,CAAC,QAAQ,EAAE,YAAY,CAAC,CAAC;IAE9E,OAAO,qBAAqB,CAAC;QAC3B,KAAK;QACL,WAAW,EAAE,eAAe,CAAC,KAAK,EAAE,IAAI,CAAC;QACzC,MAAM,EAAE,gBAAgB,CAAC,OAAO,CAAC;QACjC,SAAS;QACT,UAAU;QACV,mBAAmB,EAAE,IAAI,CAAC,mBAAmB,IAAI,KAAK;QACtD,MAAM,EAAE,IAAI,CAAC,MAAM;QACnB,GAAG,EAAE,IAAI,CAAC,GAAG;QACb,OAAO;QACP,WAAW;KACZ,CAAC,CAAC;AACL,CAAC;AAED;;;;;;;GAOG;AACH,MAAM,UAAU,yBAAyB,CACvC,IAAiC;IAEjC,OAAO,KAAK,EAAE,IAAoB,EAA6B,EAAE;QAC/D,MAAM,EAAE,MAAM,EAAE,OAAO,EAAE,GAAG,MAAM,wBAAwB,CAAC,IAAI,EAAE,IAAI,CAAC,CAAC;QAEvE,8EAA8E;QAC9E,IAAI,IAAI,CAAC,SAAS,EAAE,CAAC;YACnB,IAAI,CAAC,SAAS,CAAC,OAAO,CAAC,CAAC;QAC1B,CAAC;aAAM,CAAC;YACN,EAAE,CAAC,SAAS,CAAC,IAAI,CAAC,QAAQ,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;YACjD,EAAE,CAAC,aAAa,CACd,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,QAAQ,EAAE,YAAY,CAAC,EACtC,IAAI,CAAC,SAAS,CAAC,OAAO,EAAE,IAAI,EAAE,CAAC,CAAC,EAChC,OAAO,CACR,CAAC;QACJ,CAAC;QAED,OAAO,MAAM,CAAC;IAChB,CAAC,CAAC;AACJ,CAAC"}

package/dist/commands/spine-cert-run-corpus.test.js

@@ -1,3 +1,4 @@
+import { createHash } from 'node:crypto';
 import * as fs from 'node:fs';
 import * as os from 'node:os';
 import * as path from 'node:path';
@@ -84,10 +85,10 @@ function stage4(files) {
         readFile: (f) => f in files ? Promise.resolve(files[f]) : Promise.reject(new Error(`absent ${f}`)),
     };
 }
-/** A minimal lock partial — the provider reads only the L2 hash + resolved corpus. */
-function lockWith(llmReplaySha) {
+/** A minimal lock partial — the provider reads the L2 hash, the pr-diffs digest, + resolved corpus. */
+function lockWith(llmReplaySha, prDiffsSha) {
     return {
-        controls: { integrity: { llmReplaySha } },
+        controls: { integrity: { llmReplaySha, prDiffsSha } },
         corpus: { resolvedPrs: [{ pr: 1, mergeCommit: sha(1) }] },
     };
 }
@@ -130,6 +131,12 @@ async function fixtureHash() {
     });
     return hash;
 }
+/** sha256 of the CRLF→LF-normalized on-disk pr-diffs.json — the digest the run gate (#2225) asserts. */
+function prDiffsHash() {
+    return createHash('sha256')
+        .update(fs.readFileSync(path.join(gate1Dir, 'pr-diffs.json'), 'utf-8').replace(/\r\n/g, '\n'), 'utf-8')
+        .digest('hex');
+}
 // ─── Tests ───────────────────────────────────────────
 describe('buildReplayCorpusProvider (run-path)', () => {
     it('loads the committed fixtures + replays them into a corpus (zero LLM/network)', async () => {
@@ -143,7 +150,7 @@ describe('buildReplayCorpusProvider (run-path)', () => {
                 captured = l;
             },
         });
-        const corpus = await provider(lockWith(hash));
+        const corpus = await provider(lockWith(hash, prDiffsHash()));
         expect(corpus.rules).toHaveLength(1);
         expect(corpus.provenanceByRule.get(corpus.rules[0].lessonHash)?.mergedPr).toBe(1);
         // fold-I ledgers emitted via the sink.
@@ -164,8 +171,30 @@ describe('buildReplayCorpusProvider (run-path)', () => {
             stage4: stage4({ 'src/a.ts': 'forbiddenCall()' }),
             now: NOW,
         });
-        await provider(lockWith(hash));
+        await provider(lockWith(hash, prDiffsHash()));
         expect(fs.existsSync(path.join(gate1Dir, 'miner-ledgers.json'))).toBe(true);
     });
+    it('throws loud when the lock lacks the prDiffsSha digest (#2225 scoring-source gate)', async () => {
+        const hash = await fixtureHash();
+        const provider = buildReplayCorpusProvider({
+            gate1Dir,
+            stage4: stage4({ 'src/a.ts': 'forbiddenCall()' }),
+            now: NOW,
+        });
+        // llmReplaySha present, prDiffsSha omitted → the fold-2 gate fires.
+        await expect(provider(lockWith(hash, undefined))).rejects.toThrow(/prDiffsSha/);
+    });
+    it('throws loud when pr-diffs.json is tampered after freeze (#2225 fold-2)', async () => {
+        const hash = await fixtureHash();
+        const lock = lockWith(hash, prDiffsHash()); // digest captured over the frozen bytes
+        // a schema-valid but byte-different scoring source — passes Zod, fails the digest.
+        fs.writeFileSync(path.join(gate1Dir, 'pr-diffs.json'), JSON.stringify([{ pr: 1, diff: 'tampered', controlKind: 'corpus' }]), 'utf-8');
+        const provider = buildReplayCorpusProvider({
+            gate1Dir,
+            stage4: stage4({ 'src/a.ts': 'forbiddenCall()' }),
+            now: NOW,
+        });
+        await expect(provider(lock)).rejects.toThrow(/pr-diffs\.json integrity/);
+    });
 });
 //# sourceMappingURL=spine-cert-run-corpus.test.js.map

package/dist/commands/spine-cert-run-corpus.test.js.map

@@ -1 +1 @@
-{"version":3,"file":"spine-cert-run-corpus.test.js","sourceRoot":"","sources":["../../src/commands/spine-cert-run-corpus.test.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,MAAM,SAAS,CAAC;AAC9B,OAAO,KAAK,EAAE,MAAM,SAAS,CAAC;AAC9B,OAAO,KAAK,IAAI,MAAM,WAAW,CAAC;AAElC,OAAO,EAAE,SAAS,EAAE,UAAU,EAAE,QAAQ,EAAE,MAAM,EAAE,EAAE,EAAE,MAAM,QAAQ,CAAC;AAgBrE,OAAO,EAAE,mBAAmB,EAAE,MAAM,wBAAwB,CAAC;AAC7D,OAAO,EAAE,yBAAyB,EAAE,MAAM,4BAA4B,CAAC;AACvE,OAAO,EAAyB,uBAAuB,EAAE,MAAM,uBAAuB,CAAC;AAEvF,wDAAwD;AAExD,MAAM,GAAG,GAAG,CAAC,CAAS,EAAU,EAAE,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,EAAE,EAAE,GAAG,CAAC,CAAC;AAC/D,MAAM,GAAG,GAAG,0BAA0B,CAAC;AAEvC,MAAM,SAAS,GAAG;IAChB,iCAAiC;IACjC,mBAAmB;IACnB,uBAAuB;IACvB,EAAE;IACF,iBAAiB;IACjB,OAAO;IACP,iBAAiB;IACjB,KAAK;CACN,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;AAEb,MAAM,UAAU,GAAqB;IACnC,kBAAkB,EAAE,GAAG,CAAC,EAAE,CAAC;IAC3B,gBAAgB,EAAE,GAAG,CAAC,EAAE,CAAC;IACzB,QAAQ,EAAE,WAAW;IACrB,KAAK,EAAE,aAAa;IACpB,WAAW,EAAE,CAAC;IACd,mBAAmB,EAAE,YAAY;IACjC,WAAW,EAAE,sBAAsB;IACnC,UAAU,EAAE,IAAI;IAChB,YAAY,EAAE,YAAY;CAC3B,CAAC;AAEF,MAAM,KAAK,GAAkB;IAC3B,UAAU,EAAE,GAAG,CAAC,GAAG,CAAC;IACpB,QAAQ,EAAE,CAAC,CAAC,CAAC;IACb,UAAU,EAAE,EAAE;IACd,WAAW,EAAE,EAAE;IACf,kBAAkB,EAAE,EAAE;IACtB,kBAAkB,EAAE,EAAE;IACtB,SAAS,EAAE,EAAE,SAAS,EAAE,uBAAuB,EAAE,QAAQ,EAAE,CAAC,EAAE;CAC/D,CAAC;AAEF,MAAM,YAAY,GAAgB;IAChC,KAAK,EAAE,KAAK;IACZ,MAAM,EAAE,CAAC,CAAC,CAAC;IACX,kBAAkB,EAAE,CAAC,EAAE,EAAE,EAAE,CAAC,EAAE,WAAW,EAAE,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC;CACrD,CAAC;AAEF,SAAS,OAAO,CAAC,EAAU;IACzB,OAAO;QACL,EAAE;QACF,cAAc,EAAE,GAAG,CAAC,EAAE,CAAC;QACvB,OAAO,EAAE;YACP;gBACE,IAAI,EAAE,UAAU;gBAChB,QAAQ,EAAE,CAAC,EAAE,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,EAAE,CAAC;gBAC5C,UAAU,EAAE,KAAK;gBACjB,UAAU,EAAE,KAAK;aAClB;SACF;KACF,CAAC;AACJ,CAAC;AAED,SAAS,UAAU;IACjB,OAAO;QACL,KAAK,CAAC,KAAK,CAAC,EAAU;YACpB,OAAO,EAAE,IAAI,EAAE,IAAI,EAAE,OAAO,EAAE,OAAO,CAAC,EAAE,CAAC,EAAE,CAAC;QAC9C,CAAC;KACF,CAAC;AACJ,CAAC;AACD,SAAS,aAAa;IACpB,OAAO;QACL,KAAK,CAAC,KAAK;YACT,OAAO,CAAC,SAAS,CAAC,CAAC;QACrB,CAAC;KACF,CAAC;AACJ,CAAC;AACD,SAAS,cAAc;IACrB,OAAO;QACL,KAAK,CAAC,QAAQ;YACZ,OAAO,EAAE,WAAW,EAAE,YAAY,EAAE,iBAAiB,EAAE,YAAY,EAAE,CAAC;QACxE,CAAC;KACF,CAAC;AACJ,CAAC;AACD,SAAS,MAAM,CAAC,KAA6B;IAC3C,OAAO;QACL,SAAS,EAAE,GAAG,EAAE,CAAC,OAAO,CAAC,OAAO,CAAC,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;QACpD,QAAQ,EAAE,CAAC,CAAS,EAAE,EAAE,CACtB,CAAC,IAAI,KAAK,CAAC,CAAC,CAAC,OAAO,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,CAAW,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,MAAM,CAAC,IAAI,KAAK,CAAC,UAAU,CAAC,EAAE,CAAC,CAAC;KAC9F,CAAC;AACJ,CAAC;AAED,sFAAsF;AACtF,SAAS,QAAQ,CAAC,YAAqB;IACrC,OAAO;QACL,QAAQ,EAAE,EAAE,SAAS,EAAE,EAAE,YAAY,EAAE,EAAE;QACzC,MAAM,EAAE,EAAE,WAAW,EAAE,CAAC,EAAE,EAAE,EAAE,CAAC,EAAE,WAAW,EAAE,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE;KAC7B,CAAC;AACjC,CAAC;AAED,IAAI,MAAc,CAAC;AACnB,IAAI,QAAgB,CAAC;AAErB,UAAU,CAAC,KAAK,IAAI,EAAE;IACpB,MAAM,GAAG,EAAE,CAAC,WAAW,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,MAAM,EAAE,EAAE,iBAAiB,CAAC,CAAC,CAAC;IACnE,QAAQ,GAAG,IAAI,CAAC,IAAI,CAAC,MAAM,EAAE,QAAQ,CAAC,CAAC;IACvC,EAAE,CAAC,SAAS,CAAC,QAAQ,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;IAE5C,2EAA2E;IAC3E,sCAAsC;IACtC,MAAM,EAAE,QAAQ,EAAE,GAAG,MAAM,mBAAmB,CAAC;QAC7C,KAAK,EAAE,KAAK;QACZ,WAAW,EAAE,YAAY;QACzB,MAAM,EAAE,UAAU,EAAE;QACpB,aAAa,EAAE,aAAa,EAAE;QAC9B,cAAc,EAAE,cAAc,EAAE;QAChC,mBAAmB,EAAE,KAAK;QAC1B,UAAU,EAAE,UAAU;KACvB,CAAC,CAAC;IAEH,EAAE,CAAC,aAAa,CAAC,IAAI,CAAC,IAAI,CAAC,QAAQ,EAAE,YAAY,CAAC,EAAE,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC,EAAE,OAAO,CAAC,CAAC;IACpF,EAAE,CAAC,aAAa,CACd,IAAI,CAAC,IAAI,CAAC,QAAQ,EAAE,oBAAoB,CAAC,EACzC,uBAAuB,CAAC,QAAQ,CAAC,EACjC,OAAO,CACR,CAAC;IACF,EAAE,CAAC,aAAa,CACd,IAAI,CAAC,IAAI,CAAC,QAAQ,EAAE,qBAAqB,CAAC,EAC1C,IAAI,CAAC,SAAS,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,CAAC,EAC5B,OAAO,CACR,CAAC;IACF,EAAE,CAAC,aAAa,CAAC,IAAI,CAAC,IAAI,CAAC,QAAQ,EAAE,eAAe,CAAC,EAAE,IAAI,CAAC,SAAS,CAAC,EAAE,CAAC,EAAE,OAAO,CAAC,CAAC;IACpF,EAAE,CAAC,aAAa,CAAC,IAAI,CAAC,IAAI,CAAC,QAAQ,EAAE,0BAA0B,CAAC,EAAE,IAAI,CAAC,SAAS,CAAC,EAAE,CAAC,EAAE,OAAO,CAAC,CAAC;AACjG,CAAC,CAAC,CAAC;AAEH,SAAS,CAAC,GAAG,EAAE;IACb,EAAE,CAAC,MAAM,CAAC,MAAM,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC;AACtD,CAAC,CAAC,CAAC;AAEH,sFAAsF;AACtF,KAAK,UAAU,WAAW;IACxB,MAAM,EAAE,IAAI,EAAE,GAAG,MAAM,mBAAmB,CAAC;QACzC,KAAK,EAAE,KAAK;QACZ,WAAW,EAAE,YAAY;QACzB,MAAM,EAAE,UAAU,EAAE;QACpB,aAAa,EAAE,aAAa,EAAE;QAC9B,cAAc,EAAE,cAAc,EAAE;QAChC,mBAAmB,EAAE,KAAK;QAC1B,UAAU,EAAE,UAAU;KACvB,CAAC,CAAC;IACH,OAAO,IAAI,CAAC;AACd,CAAC;AAED,wDAAwD;AAExD,QAAQ,CAAC,sCAAsC,EAAE,GAAG,EAAE;IACpD,EAAE,CAAC,8EAA8E,EAAE,KAAK,IAAI,EAAE;QAC5F,MAAM,IAAI,GAAG,MAAM,WAAW,EAAE,CAAC;QACjC,IAAI,QAAkC,CAAC;QACvC,MAAM,QAAQ,GAAG,yBAAyB,CAAC;YACzC,QAAQ;YACR,MAAM,EAAE,MAAM,CAAC,EAAE,UAAU,EAAE,iBAAiB,EAAE,CAAC;YACjD,GAAG,EAAE,GAAG;YACR,SAAS,EAAE,CAAC,CAAC,EAAE,EAAE;gBACf,QAAQ,GAAG,CAAC,CAAC;YACf,CAAC;SACF,CAAC,CAAC;QAEH,MAAM,MAAM,GAAG,MAAM,QAAQ,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAC;QAE9C,MAAM,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,YAAY,CAAC,CAAC,CAAC,CAAC;QACrC,MAAM,CAAC,MAAM,CAAC,gBAAgB,CAAC,GAAG,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,CAAE,CAAC,UAAU,CAAC,EAAE,QAAQ,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;QACnF,uCAAuC;QACvC,MAAM,CAAC,QAAQ,EAAE,QAAQ,CAAC,iBAAiB,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IACvD,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,yEAAyE,EAAE,KAAK,IAAI,EAAE;QACvF,MAAM,QAAQ,GAAG,yBAAyB,CAAC;YACzC,QAAQ;YACR,MAAM,EAAE,MAAM,CAAC,EAAE,UAAU,EAAE,iBAAiB,EAAE,CAAC;YACjD,GAAG,EAAE,GAAG;SACT,CAAC,CAAC;QACH,MAAM,MAAM,CAAC,QAAQ,CAAC,QAAQ,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,OAAO,CAAC,cAAc,CAAC,CAAC;IAC9E,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,8DAA8D,EAAE,KAAK,IAAI,EAAE;QAC5E,MAAM,IAAI,GAAG,MAAM,WAAW,EAAE,CAAC;QACjC,MAAM,QAAQ,GAAG,yBAAyB,CAAC;YACzC,QAAQ;YACR,MAAM,EAAE,MAAM,CAAC,EAAE,UAAU,EAAE,iBAAiB,EAAE,CAAC;YACjD,GAAG,EAAE,GAAG;SACT,CAAC,CAAC;QACH,MAAM,QAAQ,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAC;QAC/B,MAAM,CAAC,EAAE,CAAC,UAAU,CAAC,IAAI,CAAC,IAAI,CAAC,QAAQ,EAAE,oBAAoB,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IAC9E,CAAC,CAAC,CAAC;AACL,CAAC,CAAC,CAAC"}
+{"version":3,"file":"spine-cert-run-corpus.test.js","sourceRoot":"","sources":["../../src/commands/spine-cert-run-corpus.test.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AACzC,OAAO,KAAK,EAAE,MAAM,SAAS,CAAC;AAC9B,OAAO,KAAK,EAAE,MAAM,SAAS,CAAC;AAC9B,OAAO,KAAK,IAAI,MAAM,WAAW,CAAC;AAElC,OAAO,EAAE,SAAS,EAAE,UAAU,EAAE,QAAQ,EAAE,MAAM,EAAE,EAAE,EAAE,MAAM,QAAQ,CAAC;AAgBrE,OAAO,EAAE,mBAAmB,EAAE,MAAM,wBAAwB,CAAC;AAC7D,OAAO,EAAE,yBAAyB,EAAE,MAAM,4BAA4B,CAAC;AACvE,OAAO,EAAyB,uBAAuB,EAAE,MAAM,uBAAuB,CAAC;AAEvF,wDAAwD;AAExD,MAAM,GAAG,GAAG,CAAC,CAAS,EAAU,EAAE,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,EAAE,EAAE,GAAG,CAAC,CAAC;AAC/D,MAAM,GAAG,GAAG,0BAA0B,CAAC;AAEvC,MAAM,SAAS,GAAG;IAChB,iCAAiC;IACjC,mBAAmB;IACnB,uBAAuB;IACvB,EAAE;IACF,iBAAiB;IACjB,OAAO;IACP,iBAAiB;IACjB,KAAK;CACN,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;AAEb,MAAM,UAAU,GAAqB;IACnC,kBAAkB,EAAE,GAAG,CAAC,EAAE,CAAC;IAC3B,gBAAgB,EAAE,GAAG,CAAC,EAAE,CAAC;IACzB,QAAQ,EAAE,WAAW;IACrB,KAAK,EAAE,aAAa;IACpB,WAAW,EAAE,CAAC;IACd,mBAAmB,EAAE,YAAY;IACjC,WAAW,EAAE,sBAAsB;IACnC,UAAU,EAAE,IAAI;IAChB,YAAY,EAAE,YAAY;CAC3B,CAAC;AAEF,MAAM,KAAK,GAAkB;IAC3B,UAAU,EAAE,GAAG,CAAC,GAAG,CAAC;IACpB,QAAQ,EAAE,CAAC,CAAC,CAAC;IACb,UAAU,EAAE,EAAE;IACd,WAAW,EAAE,EAAE;IACf,kBAAkB,EAAE,EAAE;IACtB,kBAAkB,EAAE,EAAE;IACtB,SAAS,EAAE,EAAE,SAAS,EAAE,uBAAuB,EAAE,QAAQ,EAAE,CAAC,EAAE;CAC/D,CAAC;AAEF,MAAM,YAAY,GAAgB;IAChC,KAAK,EAAE,KAAK;IACZ,MAAM,EAAE,CAAC,CAAC,CAAC;IACX,kBAAkB,EAAE,CAAC,EAAE,EAAE,EAAE,CAAC,EAAE,WAAW,EAAE,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC;CACrD,CAAC;AAEF,SAAS,OAAO,CAAC,EAAU;IACzB,OAAO;QACL,EAAE;QACF,cAAc,EAAE,GAAG,CAAC,EAAE,CAAC;QACvB,OAAO,EAAE;YACP;gBACE,IAAI,EAAE,UAAU;gBAChB,QAAQ,EAAE,CAAC,EAAE,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,EAAE,CAAC;gBAC5C,UAAU,EAAE,KAAK;gBACjB,UAAU,EAAE,KAAK;aAClB;SACF;KACF,CAAC;AACJ,CAAC;AAED,SAAS,UAAU;IACjB,OAAO;QACL,KAAK,CAAC,KAAK,CAAC,EAAU;YACpB,OAAO,EAAE,IAAI,EAAE,IAAI,EAAE,OAAO,EAAE,OAAO,CAAC,EAAE,CAAC,EAAE,CAAC;QAC9C,CAAC;KACF,CAAC;AACJ,CAAC;AACD,SAAS,aAAa;IACpB,OAAO;QACL,KAAK,CAAC,KAAK;YACT,OAAO,CAAC,SAAS,CAAC,CAAC;QACrB,CAAC;KACF,CAAC;AACJ,CAAC;AACD,SAAS,cAAc;IACrB,OAAO;QACL,KAAK,CAAC,QAAQ;YACZ,OAAO,EAAE,WAAW,EAAE,YAAY,EAAE,iBAAiB,EAAE,YAAY,EAAE,CAAC;QACxE,CAAC;KACF,CAAC;AACJ,CAAC;AACD,SAAS,MAAM,CAAC,KAA6B;IAC3C,OAAO;QACL,SAAS,EAAE,GAAG,EAAE,CAAC,OAAO,CAAC,OAAO,CAAC,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;QACpD,QAAQ,EAAE,CAAC,CAAS,EAAE,EAAE,CACtB,CAAC,IAAI,KAAK,CAAC,CAAC,CAAC,OAAO,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,CAAW,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,MAAM,CAAC,IAAI,KAAK,CAAC,UAAU,CAAC,EAAE,CAAC,CAAC;KAC9F,CAAC;AACJ,CAAC;AAED,uGAAuG;AACvG,SAAS,QAAQ,CAAC,YAAqB,EAAE,UAAmB;IAC1D,OAAO;QACL,QAAQ,EAAE,EAAE,SAAS,EAAE,EAAE,YAAY,EAAE,UAAU,EAAE,EAAE;QACrD,MAAM,EAAE,EAAE,WAAW,EAAE,CAAC,EAAE,EAAE,EAAE,CAAC,EAAE,WAAW,EAAE,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE;KAC7B,CAAC;AACjC,CAAC;AAED,IAAI,MAAc,CAAC;AACnB,IAAI,QAAgB,CAAC;AAErB,UAAU,CAAC,KAAK,IAAI,EAAE;IACpB,MAAM,GAAG,EAAE,CAAC,WAAW,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,MAAM,EAAE,EAAE,iBAAiB,CAAC,CAAC,CAAC;IACnE,QAAQ,GAAG,IAAI,CAAC,IAAI,CAAC,MAAM,EAAE,QAAQ,CAAC,CAAC;IACvC,EAAE,CAAC,SAAS,CAAC,QAAQ,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;IAE5C,2EAA2E;IAC3E,sCAAsC;IACtC,MAAM,EAAE,QAAQ,EAAE,GAAG,MAAM,mBAAmB,CAAC;QAC7C,KAAK,EAAE,KAAK;QACZ,WAAW,EAAE,YAAY;QACzB,MAAM,EAAE,UAAU,EAAE;QACpB,aAAa,EAAE,aAAa,EAAE;QAC9B,cAAc,EAAE,cAAc,EAAE;QAChC,mBAAmB,EAAE,KAAK;QAC1B,UAAU,EAAE,UAAU;KACvB,CAAC,CAAC;IAEH,EAAE,CAAC,aAAa,CAAC,IAAI,CAAC,IAAI,CAAC,QAAQ,EAAE,YAAY,CAAC,EAAE,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC,EAAE,OAAO,CAAC,CAAC;IACpF,EAAE,CAAC,aAAa,CACd,IAAI,CAAC,IAAI,CAAC,QAAQ,EAAE,oBAAoB,CAAC,EACzC,uBAAuB,CAAC,QAAQ,CAAC,EACjC,OAAO,CACR,CAAC;IACF,EAAE,CAAC,aAAa,CACd,IAAI,CAAC,IAAI,CAAC,QAAQ,EAAE,qBAAqB,CAAC,EAC1C,IAAI,CAAC,SAAS,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,CAAC,EAC5B,OAAO,CACR,CAAC;IACF,EAAE,CAAC,aAAa,CAAC,IAAI,CAAC,IAAI,CAAC,QAAQ,EAAE,eAAe,CAAC,EAAE,IAAI,CAAC,SAAS,CAAC,EAAE,CAAC,EAAE,OAAO,CAAC,CAAC;IACpF,EAAE,CAAC,aAAa,CAAC,IAAI,CAAC,IAAI,CAAC,QAAQ,EAAE,0BAA0B,CAAC,EAAE,IAAI,CAAC,SAAS,CAAC,EAAE,CAAC,EAAE,OAAO,CAAC,CAAC;AACjG,CAAC,CAAC,CAAC;AAEH,SAAS,CAAC,GAAG,EAAE;IACb,EAAE,CAAC,MAAM,CAAC,MAAM,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC;AACtD,CAAC,CAAC,CAAC;AAEH,sFAAsF;AACtF,KAAK,UAAU,WAAW;IACxB,MAAM,EAAE,IAAI,EAAE,GAAG,MAAM,mBAAmB,CAAC;QACzC,KAAK,EAAE,KAAK;QACZ,WAAW,EAAE,YAAY;QACzB,MAAM,EAAE,UAAU,EAAE;QACpB,aAAa,EAAE,aAAa,EAAE;QAC9B,cAAc,EAAE,cAAc,EAAE;QAChC,mBAAmB,EAAE,KAAK;QAC1B,UAAU,EAAE,UAAU;KACvB,CAAC,CAAC;IACH,OAAO,IAAI,CAAC;AACd,CAAC;AAED,wGAAwG;AACxG,SAAS,WAAW;IAClB,OAAO,UAAU,CAAC,QAAQ,CAAC;SACxB,MAAM,CACL,EAAE,CAAC,YAAY,CAAC,IAAI,CAAC,IAAI,CAAC,QAAQ,EAAE,eAAe,CAAC,EAAE,OAAO,CAAC,CAAC,OAAO,CAAC,OAAO,EAAE,IAAI,CAAC,EACrF,OAAO,CACR;SACA,MAAM,CAAC,KAAK,CAAC,CAAC;AACnB,CAAC;AAED,wDAAwD;AAExD,QAAQ,CAAC,sCAAsC,EAAE,GAAG,EAAE;IACpD,EAAE,CAAC,8EAA8E,EAAE,KAAK,IAAI,EAAE;QAC5F,MAAM,IAAI,GAAG,MAAM,WAAW,EAAE,CAAC;QACjC,IAAI,QAAkC,CAAC;QACvC,MAAM,QAAQ,GAAG,yBAAyB,CAAC;YACzC,QAAQ;YACR,MAAM,EAAE,MAAM,CAAC,EAAE,UAAU,EAAE,iBAAiB,EAAE,CAAC;YACjD,GAAG,EAAE,GAAG;YACR,SAAS,EAAE,CAAC,CAAC,EAAE,EAAE;gBACf,QAAQ,GAAG,CAAC,CAAC;YACf,CAAC;SACF,CAAC,CAAC;QAEH,MAAM,MAAM,GAAG,MAAM,QAAQ,CAAC,QAAQ,CAAC,IAAI,EAAE,WAAW,EAAE,CAAC,CAAC,CAAC;QAE7D,MAAM,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,YAAY,CAAC,CAAC,CAAC,CAAC;QACrC,MAAM,CAAC,MAAM,CAAC,gBAAgB,CAAC,GAAG,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,CAAE,CAAC,UAAU,CAAC,EAAE,QAAQ,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;QACnF,uCAAuC;QACvC,MAAM,CAAC,QAAQ,EAAE,QAAQ,CAAC,iBAAiB,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IACvD,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,yEAAyE,EAAE,KAAK,IAAI,EAAE;QACvF,MAAM,QAAQ,GAAG,yBAAyB,CAAC;YACzC,QAAQ;YACR,MAAM,EAAE,MAAM,CAAC,EAAE,UAAU,EAAE,iBAAiB,EAAE,CAAC;YACjD,GAAG,EAAE,GAAG;SACT,CAAC,CAAC;QACH,MAAM,MAAM,CAAC,QAAQ,CAAC,QAAQ,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,OAAO,CAAC,cAAc,CAAC,CAAC;IAC9E,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,8DAA8D,EAAE,KAAK,IAAI,EAAE;QAC5E,MAAM,IAAI,GAAG,MAAM,WAAW,EAAE,CAAC;QACjC,MAAM,QAAQ,GAAG,yBAAyB,CAAC;YACzC,QAAQ;YACR,MAAM,EAAE,MAAM,CAAC,EAAE,UAAU,EAAE,iBAAiB,EAAE,CAAC;YACjD,GAAG,EAAE,GAAG;SACT,CAAC,CAAC;QACH,MAAM,QAAQ,CAAC,QAAQ,CAAC,IAAI,EAAE,WAAW,EAAE,CAAC,CAAC,CAAC;QAC9C,MAAM,CAAC,EAAE,CAAC,UAAU,CAAC,IAAI,CAAC,IAAI,CAAC,QAAQ,EAAE,oBAAoB,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IAC9E,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,mFAAmF,EAAE,KAAK,IAAI,EAAE;QACjG,MAAM,IAAI,GAAG,MAAM,WAAW,EAAE,CAAC;QACjC,MAAM,QAAQ,GAAG,yBAAyB,CAAC;YACzC,QAAQ;YACR,MAAM,EAAE,MAAM,CAAC,EAAE,UAAU,EAAE,iBAAiB,EAAE,CAAC;YACjD,GAAG,EAAE,GAAG;SACT,CAAC,CAAC;QACH,oEAAoE;QACpE,MAAM,MAAM,CAAC,QAAQ,CAAC,QAAQ,CAAC,IAAI,EAAE,SAAS,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,OAAO,CAAC,YAAY,CAAC,CAAC;IAClF,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,wEAAwE,EAAE,KAAK,IAAI,EAAE;QACtF,MAAM,IAAI,GAAG,MAAM,WAAW,EAAE,CAAC;QACjC,MAAM,IAAI,GAAG,QAAQ,CAAC,IAAI,EAAE,WAAW,EAAE,CAAC,CAAC,CAAC,wCAAwC;QACpF,mFAAmF;QACnF,EAAE,CAAC,aAAa,CACd,IAAI,CAAC,IAAI,CAAC,QAAQ,EAAE,eAAe,CAAC,EACpC,IAAI,CAAC,SAAS,CAAC,CAAC,EAAE,EAAE,EAAE,CAAC,EAAE,IAAI,EAAE,UAAU,EAAE,WAAW,EAAE,QAAQ,EAAE,CAAC,CAAC,EACpE,OAAO,CACR,CAAC;QACF,MAAM,QAAQ,GAAG,yBAAyB,CAAC;YACzC,QAAQ;YACR,MAAM,EAAE,MAAM,CAAC,EAAE,UAAU,EAAE,iBAAiB,EAAE,CAAC;YACjD,GAAG,EAAE,GAAG;SACT,CAAC,CAAC;QACH,MAAM,MAAM,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAC,OAAO,CAAC,OAAO,CAAC,0BAA0B,CAAC,CAAC;IAC3E,CAAC,CAAC,CAAC;AACL,CAAC,CAAC,CAAC"}

package/dist/commands/spine-corpus-disposition-source.d.ts

@@ -0,0 +1,179 @@
+/**
+ * #709 ground-truth deriver — slice 5d-ii: the live held-out disposition adapter.
+ *
+ * Fetches a HELD-OUT corpus PR's review threads WITH span anchoring (the comment
+ * `diffHunk` + the thread line) — the data slice 5d-iii binds a `RuleFiring`'s
+ * matched line to a disposition by content/invariant. Distinct from the mining
+ * `ReviewThreadSourceAdapter` (which fetches TRAIN PRs and carries no span): the
+ * answer key labels HELD-OUT firings, so it needs the held-out PRs' threads,
+ * span-anchored, and a richer `CorpusDisposition` payload (core schema).
+ *
+ * Like the mining adapter, this SURFACES `isResolved`/`isOutdated` and never
+ * filters on them (the #2201 "surface, don't filter" discipline; the taxonomy +
+ * span-bind decide, 5d-i/5d-iii). Unlike it, a fetch failure FAILS LOUD: the
+ * disposition freeze is a by-hand, all-or-nothing producer step (a silent skip
+ * would under-populate the answer-key provenance), so a network/parse/pagination
+ * fault throws a structured TotemError rather than a discriminated skip.
+ *
+ * CI HARD-GATE (agy panel): a live GitHub fetch must NEVER run in CI — the
+ * certifying run is zero-network and reads only the FROZEN `corpus-dispositions.json`.
+ * `fetch` throws if `CI` is set without an explicit `ALLOW_LIVE_FETCH` escape, so
+ * an accidental test/CI invocation fails loud instead of hitting the network.
+ *
+ * Reuses the established `gh` CLI exec pattern (Tenet-21 — no bespoke GraphQL
+ * client). The `exec` seam is injectable so the query-spy + mapping + CI-gate
+ * tests run fully offline.
+ */
+import { z } from 'zod';
+import type { CorpusDisposition, CorpusDispositionThread } from '@mmnto/totem';
+import type { GhExec } from './spine-review-thread-source.js';
+declare const GqlThreadSchema: z.ZodObject<{
+    id: z.ZodString;
+    isResolved: z.ZodBoolean;
+    isOutdated: z.ZodBoolean;
+    path: z.ZodString;
+    line: z.ZodNullable<z.ZodNumber>;
+    originalLine: z.ZodNullable<z.ZodNumber>;
+    comments: z.ZodObject<{
+        pageInfo: z.ZodObject<{
+            hasNextPage: z.ZodBoolean;
+        }, "strip", z.ZodTypeAny, {
+            hasNextPage: boolean;
+        }, {
+            hasNextPage: boolean;
+        }>;
+        nodes: z.ZodArray<z.ZodObject<{
+            databaseId: z.ZodNullable<z.ZodNumber>;
+            diffHunk: z.ZodNullable<z.ZodString>;
+            author: z.ZodNullable<z.ZodObject<{
+                login: z.ZodString;
+            }, "strip", z.ZodTypeAny, {
+                login: string;
+            }, {
+                login: string;
+            }>>;
+            body: z.ZodString;
+        }, "strip", z.ZodTypeAny, {
+            body: string;
+            author: {
+                login: string;
+            } | null;
+            databaseId: number | null;
+            diffHunk: string | null;
+        }, {
+            body: string;
+            author: {
+                login: string;
+            } | null;
+            databaseId: number | null;
+            diffHunk: string | null;
+        }>, "many">;
+    }, "strip", z.ZodTypeAny, {
+        pageInfo: {
+            hasNextPage: boolean;
+        };
+        nodes: {
+            body: string;
+            author: {
+                login: string;
+            } | null;
+            databaseId: number | null;
+            diffHunk: string | null;
+        }[];
+    }, {
+        pageInfo: {
+            hasNextPage: boolean;
+        };
+        nodes: {
+            body: string;
+            author: {
+                login: string;
+            } | null;
+            databaseId: number | null;
+            diffHunk: string | null;
+        }[];
+    }>;
+}, "strip", z.ZodTypeAny, {
+    line: number | null;
+    path: string;
+    id: string;
+    comments: {
+        pageInfo: {
+            hasNextPage: boolean;
+        };
+        nodes: {
+            body: string;
+            author: {
+                login: string;
+            } | null;
+            databaseId: number | null;
+            diffHunk: string | null;
+        }[];
+    };
+    isResolved: boolean;
+    isOutdated: boolean;
+    originalLine: number | null;
+}, {
+    line: number | null;
+    path: string;
+    id: string;
+    comments: {
+        pageInfo: {
+            hasNextPage: boolean;
+        };
+        nodes: {
+            body: string;
+            author: {
+                login: string;
+            } | null;
+            databaseId: number | null;
+            diffHunk: string | null;
+        }[];
+    };
+    isResolved: boolean;
+    isOutdated: boolean;
+    originalLine: number | null;
+}>;
+/**
+ * Build the held-out `reviewThreads` GraphQL query. ADDITIVELY requests the span
+ * anchors (`line`, `originalLine`, comment `diffHunk`) + the audit ids
+ * (`thread.id`, comment `databaseId`) on top of the mining query's
+ * `isResolved`/`isOutdated`/`path`/`author`/`body`. It deliberately does NOT add
+ * an `isResolved: false` server filter (the "surface, don't filter" ruling).
+ * Exported for the query-spy test.
+ */
+export declare function buildCorpusDispositionsQuery(owner: string, name: string, pr: number): string;
+/**
+ * Map validated GraphQL thread nodes to `CorpusDispositionThread[]`. The thread's
+ * span source `diffHunk` is the ROOT (first) comment's hunk — the finding's
+ * anchor; a thread with no comments carries ''. A null author (deleted/ghost)
+ * coerces to '' (a non-bot empty author core's logic handles). Pure — exported
+ * for the mapping test.
+ */
+export declare function mapDispositionThreads(nodes: z.infer<typeof GqlThreadSchema>[]): CorpusDispositionThread[];
+export interface CorpusDispositionSourceOptions {
+    owner: string;
+    name: string;
+    cwd?: string;
+    /** Injectable exec seam (tests). Defaults to a `gh`-backed `safeExec`. */
+    exec?: GhExec;
+    /** Process env (injected in tests) — the CI hard-gate reads it. Defaults to `process.env`. */
+    env?: NodeJS.ProcessEnv;
+}
+/**
+ * The live held-out `corpus-dispositions` source. By-hand producer-time only
+ * (never CI — the hard-gate enforces it). `fetch` throws loud on any fault.
+ */
+export declare class CorpusDispositionSourceAdapter {
+    private readonly owner;
+    private readonly name;
+    private readonly cwd;
+    private readonly env;
+    private readonly injectedExec;
+    private execPromise;
+    constructor(opts: CorpusDispositionSourceOptions);
+    private resolveExec;
+    fetch(pr: number): Promise<CorpusDisposition>;
+}
+export {};
+//# sourceMappingURL=spine-corpus-disposition-source.d.ts.map

package/dist/commands/spine-corpus-disposition-source.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"spine-corpus-disposition-source.d.ts","sourceRoot":"","sources":["../../src/commands/spine-corpus-disposition-source.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;GAyBG;AAEH,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAGxB,OAAO,KAAK,EAAE,iBAAiB,EAAE,uBAAuB,EAAE,MAAM,cAAc,CAAC;AAE/E,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,iCAAiC,CAAC;AAsB9D,QAAA,MAAM,eAAe;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;EAWnB,CAAC;AAsBH;;;;;;;GAOG;AACH,wBAAgB,4BAA4B,CAAC,KAAK,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,EAAE,EAAE,EAAE,MAAM,GAAG,MAAM,CA4B5F;AAID;;;;;;GAMG;AACH,wBAAgB,qBAAqB,CACnC,KAAK,EAAE,CAAC,CAAC,KAAK,CAAC,OAAO,eAAe,CAAC,EAAE,GACvC,uBAAuB,EAAE,CAgB3B;AAID,MAAM,WAAW,8BAA8B;IAC7C,KAAK,EAAE,MAAM,CAAC;IACd,IAAI,EAAE,MAAM,CAAC;IACb,GAAG,CAAC,EAAE,MAAM,CAAC;IACb,0EAA0E;IAC1E,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,8FAA8F;IAC9F,GAAG,CAAC,EAAE,MAAM,CAAC,UAAU,CAAC;CACzB;AAED;;;GAGG;AACH,qBAAa,8BAA8B;IACzC,OAAO,CAAC,QAAQ,CAAC,KAAK,CAAS;IAC/B,OAAO,CAAC,QAAQ,CAAC,IAAI,CAAS;IAC9B,OAAO,CAAC,QAAQ,CAAC,GAAG,CAAS;IAC7B,OAAO,CAAC,QAAQ,CAAC,GAAG,CAAoB;IACxC,OAAO,CAAC,QAAQ,CAAC,YAAY,CAAqB;IAClD,OAAO,CAAC,WAAW,CAA8B;gBAErC,IAAI,EAAE,8BAA8B;YAQlC,WAAW;IAkBnB,KAAK,CAAC,EAAE,EAAE,MAAM,GAAG,OAAO,CAAC,iBAAiB,CAAC;CAmHpD"}