@mmnto/totem 1.115.0 → 1.117.0

package/dist/attribution-sense.d.ts

@@ -0,0 +1,119 @@
+/**
+ * Agent-attribution provenance sense (mmnto-ai/totem#2629).
+ *
+ * On a shared multi-seat machine, a seat session that mints no identity of its
+ * own can inherit ANOTHER seat's attribution through two ambient channels:
+ * a wider-than-launch-shell `TOTEM_SELF_AGENT` (user/machine scope) and the
+ * shared `.totem/ledger/.session-id` pointer. A wrong-seat row corrupts two
+ * denominators; an unattributed row only under-counts — so the ruled posture
+ * (operator, 2026-08-12, on the issue) is:
+ *
+ * - **Provenance on every row, not only on mismatch:** `agent_source_provenance`
+ *   is the two-value `'env' | 'absent'` enum — `'env'` iff `agent_source` was
+ *   stamped from `TOTEM_SELF_AGENT`, `'absent'` iff no attribution was stamped
+ *   (the honest stamped-absence default, Tenet 4).
+ * - **Fail-closed at the stamp seam:** when the ambient env seat and the
+ *   session pointer's minting seat disagree, stamp NEITHER — no `agent_source`,
+ *   plus a conflict disclosure naming both candidates. Fail-closed scopes to
+ *   the *attribution*, never the *operation*: the sense never throws into its
+ *   caller, so the query/write it decorates is never refused (Tenet 13).
+ * - **Never remembered:** identity derives from process env + on-disk state at
+ *   call time, per call. No cache at any scope — a session-lifetime cache
+ *   converts a transient contamination into a whole-session one (the
+ *   `b8d7aa9b` specimen shape).
+ *
+ * The minting seat is derived from the pointer session's `session_start` row
+ * in `events.ndjson` — written by the SessionStart hook's mint block at the
+ * #2625 template, so the lookup needs no new producer. Absence of that row
+ * (pre-hook ledger, rotated file, unseated mint) is NOT a disagreement: only
+ * positive counter-evidence strips attribution.
+ *
+ * NAMED LIMIT (stated so coverage is never overread): the conflict arm fires
+ * only when two PRESENT candidates disagree — a seated process joining a
+ * foreign seat's pointer session. The b8d7aa9b specimen itself had an
+ * UNSEATED mint row (its minting process's env carried no var), and a
+ * machine-wide ambient var makes every mint agree with every process env —
+ * both shapes yield an env stamp with no conflict here: the ruling's
+ * fail-closed clause covers disagreement between two PRESENT candidates, and
+ * the missing-counter-evidence rule (design invariant 3) covers the rest. The
+ * sensors for the ambient-scope class are the provenance field (post-hoc
+ * partitioning), doctor arm (d)'s registry scope-sense, and the launch-shell
+ * scope protocol — not this predicate.
+ */
+/** The ruled two-value provenance enum — `'env' | 'absent'`, nothing else. */
+export declare const AGENT_SOURCE_PROVENANCE_VALUES: readonly ["env", "absent"];
+export type AgentSourceProvenance = (typeof AGENT_SOURCE_PROVENANCE_VALUES)[number];
+/**
+ * The fail-closed disclosure: both candidates named, so a post-hoc reader can
+ * partition contaminated windows without guessing which seat was real.
+ */
+export interface AttributionConflict {
+    /** What ambient `TOTEM_SELF_AGENT` claimed (first non-empty comma entry). */
+    env_seat: string;
+    /** What the pointer session's `session_start` row recorded at mint time. */
+    minting_seat: string;
+    /** The `.session-id` pointer value the two candidates disagree about. */
+    pointer_session_id: string;
+}
+/** The per-call sense result both stamp seams consume. */
+export interface AgentAttributionSense {
+    /** Seat to stamp, or `null` — never a guessed value (Tenet 4). */
+    agent_source: string | null;
+    /** `'env'` iff `agent_source` is non-null — writer-guaranteed biconditional. */
+    agent_source_provenance: AgentSourceProvenance;
+    /** Present iff the fail-closed rule fired (env seat ≠ minting seat). */
+    attribution_conflict?: AttributionConflict;
+    /**
+     * Present iff the conflict probe failed for a non-benign reason (EACCES-class
+     * read failure, torn pointer read throw). The env stamp stands — a broken
+     * probe is not counter-evidence — but the degradation names itself on the
+     * row rather than vanishing (Tenet 4).
+     */
+    attribution_probe_error?: string;
+}
+/** Discriminated lookup result — `found: false` is a normal state, not an error. */
+export type SessionMintingSeatLookup = {
+    found: true;
+    seat: string | null;
+} | {
+    found: false;
+};
+/**
+ * Derive the minting seat of a session from its `session_start` row in
+ * `<totemDir>/ledger/events.ndjson`.
+ *
+ * Scans BACKWARDS (newest row wins) with a cheap substring prefilter before
+ * any `JSON.parse`, so the common case — an active session whose mint row is
+ * near the tail — costs a file read plus a short scan. Malformed/torn lines
+ * are skipped per line (the `parseSearchLog` tolerance precedent): a torn
+ * `session_start` reads as not-found, never as a fabricated conflict.
+ *
+ * Absent events file (ENOENT class) returns `found: false` — the honest
+ * not-instrumented state. Every other read errno throws a `TotemError` so the
+ * caller can name the probe failure instead of silently degrading.
+ */
+export declare function readSessionMintingSeat(totemDir: string, sessionId: string): SessionMintingSeatLookup;
+export interface AgentAttributionSenseInput {
+    /**
+     * Resolved `.totem` directory. Omit to run env-only (no conflict probe) —
+     * the honest shape for callers with no ledger in reach; provenance is still
+     * disclosed.
+     */
+    totemDir?: string;
+    /** Test seam — production callers omit and the sense reads `process.env`. */
+    env?: NodeJS.ProcessEnv;
+    /**
+     * The pointer session id the caller already resolved for the row it is
+     * stamping (the manifest builder's shape — one pointer read per row, so the
+     * probe cannot race a concurrent rotation into checking a DIFFERENT session
+     * than the row joins). Omit and the probe reads the pointer itself.
+     */
+    pointerSessionId?: string;
+}
+/**
+ * Derive the agent-attribution stamp for one row. Per call, never cached —
+ * see the module contract. Never throws: every probe failure degrades to the
+ * env-only stamp with the failure named on `attribution_probe_error`.
+ */
+export declare function senseAgentAttribution(input?: AgentAttributionSenseInput): AgentAttributionSense;
+//# sourceMappingURL=attribution-sense.d.ts.map

package/dist/attribution-sense.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"attribution-sense.d.ts","sourceRoot":"","sources":["../src/attribution-sense.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAyCG;AAoBH,8EAA8E;AAC9E,eAAO,MAAM,8BAA8B,4BAA6B,CAAC;AACzE,MAAM,MAAM,qBAAqB,GAAG,CAAC,OAAO,8BAA8B,CAAC,CAAC,MAAM,CAAC,CAAC;AAEpF;;;GAGG;AACH,MAAM,WAAW,mBAAmB;IAClC,6EAA6E;IAC7E,QAAQ,EAAE,MAAM,CAAC;IACjB,4EAA4E;IAC5E,YAAY,EAAE,MAAM,CAAC;IACrB,yEAAyE;IACzE,kBAAkB,EAAE,MAAM,CAAC;CAC5B;AAED,0DAA0D;AAC1D,MAAM,WAAW,qBAAqB;IACpC,kEAAkE;IAClE,YAAY,EAAE,MAAM,GAAG,IAAI,CAAC;IAC5B,gFAAgF;IAChF,uBAAuB,EAAE,qBAAqB,CAAC;IAC/C,wEAAwE;IACxE,oBAAoB,CAAC,EAAE,mBAAmB,CAAC;IAC3C;;;;;OAKG;IACH,uBAAuB,CAAC,EAAE,MAAM,CAAC;CAClC;AAED,oFAAoF;AACpF,MAAM,MAAM,wBAAwB,GAAG;IAAE,KAAK,EAAE,IAAI,CAAC;IAAC,IAAI,EAAE,MAAM,GAAG,IAAI,CAAA;CAAE,GAAG;IAAE,KAAK,EAAE,KAAK,CAAA;CAAE,CAAC;AAE/F;;;;;;;;;;;;;GAaG;AACH,wBAAgB,sBAAsB,CACpC,QAAQ,EAAE,MAAM,EAChB,SAAS,EAAE,MAAM,GAChB,wBAAwB,CA6C1B;AAED,MAAM,WAAW,0BAA0B;IACzC;;;;OAIG;IACH,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,6EAA6E;IAC7E,GAAG,CAAC,EAAE,MAAM,CAAC,UAAU,CAAC;IACxB;;;;;OAKG;IACH,gBAAgB,CAAC,EAAE,MAAM,CAAC;CAC3B;AAED;;;;GAIG;AACH,wBAAgB,qBAAqB,CACnC,KAAK,GAAE,0BAA+B,GACrC,qBAAqB,CAgDvB"}

package/dist/attribution-sense.js

@@ -0,0 +1,167 @@
+/**
+ * Agent-attribution provenance sense (mmnto-ai/totem#2629).
+ *
+ * On a shared multi-seat machine, a seat session that mints no identity of its
+ * own can inherit ANOTHER seat's attribution through two ambient channels:
+ * a wider-than-launch-shell `TOTEM_SELF_AGENT` (user/machine scope) and the
+ * shared `.totem/ledger/.session-id` pointer. A wrong-seat row corrupts two
+ * denominators; an unattributed row only under-counts — so the ruled posture
+ * (operator, 2026-08-12, on the issue) is:
+ *
+ * - **Provenance on every row, not only on mismatch:** `agent_source_provenance`
+ *   is the two-value `'env' | 'absent'` enum — `'env'` iff `agent_source` was
+ *   stamped from `TOTEM_SELF_AGENT`, `'absent'` iff no attribution was stamped
+ *   (the honest stamped-absence default, Tenet 4).
+ * - **Fail-closed at the stamp seam:** when the ambient env seat and the
+ *   session pointer's minting seat disagree, stamp NEITHER — no `agent_source`,
+ *   plus a conflict disclosure naming both candidates. Fail-closed scopes to
+ *   the *attribution*, never the *operation*: the sense never throws into its
+ *   caller, so the query/write it decorates is never refused (Tenet 13).
+ * - **Never remembered:** identity derives from process env + on-disk state at
+ *   call time, per call. No cache at any scope — a session-lifetime cache
+ *   converts a transient contamination into a whole-session one (the
+ *   `b8d7aa9b` specimen shape).
+ *
+ * The minting seat is derived from the pointer session's `session_start` row
+ * in `events.ndjson` — written by the SessionStart hook's mint block at the
+ * #2625 template, so the lookup needs no new producer. Absence of that row
+ * (pre-hook ledger, rotated file, unseated mint) is NOT a disagreement: only
+ * positive counter-evidence strips attribution.
+ *
+ * NAMED LIMIT (stated so coverage is never overread): the conflict arm fires
+ * only when two PRESENT candidates disagree — a seated process joining a
+ * foreign seat's pointer session. The b8d7aa9b specimen itself had an
+ * UNSEATED mint row (its minting process's env carried no var), and a
+ * machine-wide ambient var makes every mint agree with every process env —
+ * both shapes yield an env stamp with no conflict here: the ruling's
+ * fail-closed clause covers disagreement between two PRESENT candidates, and
+ * the missing-counter-evidence rule (design invariant 3) covers the rest. The
+ * sensors for the ambient-scope class are the provenance field (post-hoc
+ * partitioning), doctor arm (d)'s registry scope-sense, and the launch-shell
+ * scope protocol — not this predicate.
+ */
+import * as fs from 'node:fs';
+import * as path from 'node:path';
+import { TotemError } from './errors.js';
+import { resolveQbdAgentSource } from './qbd/record.js';
+import { readSessionId } from './session-id.js';
+const LEDGER_DIR = 'ledger';
+const EVENTS_FILE = 'events.ndjson';
+/**
+ * Errnos that mean "there is no ledger here" rather than "something surprising
+ * happened" — the `session-id.ts` absence semantics, minus the permission
+ * classes: an EACCES/EPERM/EROFS events file is a real probe failure that must
+ * land on the accounting channel, not read as a clean not-instrumented state.
+ */
+const LEDGER_ABSENT_ERRNOS = new Set(['ENOENT', 'ENOTDIR']);
+/** The ruled two-value provenance enum — `'env' | 'absent'`, nothing else. */
+export const AGENT_SOURCE_PROVENANCE_VALUES = ['env', 'absent'];
+/**
+ * Derive the minting seat of a session from its `session_start` row in
+ * `<totemDir>/ledger/events.ndjson`.
+ *
+ * Scans BACKWARDS (newest row wins) with a cheap substring prefilter before
+ * any `JSON.parse`, so the common case — an active session whose mint row is
+ * near the tail — costs a file read plus a short scan. Malformed/torn lines
+ * are skipped per line (the `parseSearchLog` tolerance precedent): a torn
+ * `session_start` reads as not-found, never as a fabricated conflict.
+ *
+ * Absent events file (ENOENT class) returns `found: false` — the honest
+ * not-instrumented state. Every other read errno throws a `TotemError` so the
+ * caller can name the probe failure instead of silently degrading.
+ */
+export function readSessionMintingSeat(totemDir, sessionId) {
+    const eventsPath = path.join(totemDir, LEDGER_DIR, EVENTS_FILE);
+    let content;
+    try {
+        content = fs.readFileSync(eventsPath, 'utf-8');
+    }
+    catch (err) {
+        const code = typeof err === 'object' && err !== null ? err.code : undefined;
+        if (code !== undefined && LEDGER_ABSENT_ERRNOS.has(code)) {
+            return { found: false };
+        }
+        throw new TotemError('ATTRIBUTION_SENSE_LEDGER_READ_FAILED', 'Unexpected error reading events.ndjson for the minting-seat lookup', 'Check filesystem permissions for the .totem/ledger/events.ndjson file.', err);
+    }
+    const lines = content.split('\n');
+    for (let i = lines.length - 1; i >= 0; i--) {
+        const line = lines[i].trim();
+        if (line.length === 0)
+            continue;
+        // Substring prefilter: a JSON row with type "session_start" and this
+        // session id must contain both literals. Skips JSON.parse on the ~all
+        // non-matching rows of a large ledger.
+        if (!line.includes('"session_start"') || !line.includes(sessionId))
+            continue;
+        let obj;
+        // totem-context: intentional malformed-line tolerance — a torn/corrupt NDJSON line is skipped and the scan continues (the parseSearchLog precedent); a torn mint row must read as not-found, never crash the stamp path or fabricate a conflict.
+        try {
+            obj = JSON.parse(line);
+            // totem-context: intentional degradation — see directive above the try; dual placement so the rule fires on either the catch-keyword line or the catch-body line.
+        }
+        catch {
+            continue;
+        }
+        if (typeof obj !== 'object' || obj === null)
+            continue;
+        const rec = obj;
+        if (rec.type !== 'session_start' || rec.session_id !== sessionId)
+            continue;
+        const seat = typeof rec.agent_source === 'string' && rec.agent_source.trim().length > 0
+            ? rec.agent_source.trim()
+            : null;
+        return { found: true, seat };
+    }
+    return { found: false };
+}
+/**
+ * Derive the agent-attribution stamp for one row. Per call, never cached —
+ * see the module contract. Never throws: every probe failure degrades to the
+ * env-only stamp with the failure named on `attribution_probe_error`.
+ */
+export function senseAgentAttribution(input = {}) {
+    const env = input.env ?? process.env;
+    const envSeat = resolveQbdAgentSource(env) ?? null;
+    // No env identity → stamped absence. The pointer's minting seat is never
+    // promoted into agent_source here: one candidate is not a conflict, and
+    // stamping a seat the process did not declare would be a guess (Tenet 4).
+    if (envSeat === null) {
+        return { agent_source: null, agent_source_provenance: 'absent' };
+    }
+    if (input.totemDir === undefined) {
+        return { agent_source: envSeat, agent_source_provenance: 'env' };
+    }
+    let probeError;
+    // totem-context: intentional degradation — a failed conflict probe keeps the env stamp (a broken probe is not counter-evidence) and names itself on attribution_probe_error; throwing here would let telemetry break the tool call it decorates (Tenet 13, lesson-b1bae311).
+    try {
+        const pointerId = input.pointerSessionId ?? readSessionId(input.totemDir);
+        if (pointerId !== undefined) {
+            const minting = readSessionMintingSeat(input.totemDir, pointerId);
+            if (minting.found && minting.seat !== null && minting.seat !== envSeat) {
+                // Fail-closed: two candidates disagree — stamp neither, name both.
+                return {
+                    agent_source: null,
+                    agent_source_provenance: 'absent',
+                    attribution_conflict: {
+                        env_seat: envSeat,
+                        minting_seat: minting.seat,
+                        pointer_session_id: pointerId,
+                    },
+                };
+            }
+        }
+        // totem-context: intentional degradation — see directive above the try; dual placement so the rule fires on either the catch-keyword line or the catch-body line.
+    }
+    catch (err) {
+        // One level of cause unrolled: the wrapper text names the probe step, the
+        // cause names the errno — the half a post-hoc reader actually filters on.
+        const causeMsg = err instanceof Error && err.cause instanceof Error ? ` (${err.cause.message})` : '';
+        probeError = `${err instanceof Error ? err.message : String(err)}${causeMsg}`;
+    }
+    return {
+        agent_source: envSeat,
+        agent_source_provenance: 'env',
+        ...(probeError !== undefined && { attribution_probe_error: probeError }),
+    };
+}
+//# sourceMappingURL=attribution-sense.js.map

package/dist/attribution-sense.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"attribution-sense.js","sourceRoot":"","sources":["../src/attribution-sense.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAyCG;AAEH,OAAO,KAAK,EAAE,MAAM,SAAS,CAAC;AAC9B,OAAO,KAAK,IAAI,MAAM,WAAW,CAAC;AAElC,OAAO,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AACzC,OAAO,EAAE,qBAAqB,EAAE,MAAM,iBAAiB,CAAC;AACxD,OAAO,EAAE,aAAa,EAAE,MAAM,iBAAiB,CAAC;AAEhD,MAAM,UAAU,GAAG,QAAQ,CAAC;AAC5B,MAAM,WAAW,GAAG,eAAe,CAAC;AAEpC;;;;;GAKG;AACH,MAAM,oBAAoB,GAAG,IAAI,GAAG,CAAC,CAAC,QAAQ,EAAE,SAAS,CAAC,CAAC,CAAC;AAE5D,8EAA8E;AAC9E,MAAM,CAAC,MAAM,8BAA8B,GAAG,CAAC,KAAK,EAAE,QAAQ,CAAU,CAAC;AAoCzE;;;;;;;;;;;;;GAaG;AACH,MAAM,UAAU,sBAAsB,CACpC,QAAgB,EAChB,SAAiB;IAEjB,MAAM,UAAU,GAAG,IAAI,CAAC,IAAI,CAAC,QAAQ,EAAE,UAAU,EAAE,WAAW,CAAC,CAAC;IAChE,IAAI,OAAe,CAAC;IACpB,IAAI,CAAC;QACH,OAAO,GAAG,EAAE,CAAC,YAAY,CAAC,UAAU,EAAE,OAAO,CAAC,CAAC;IACjD,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,MAAM,IAAI,GACR,OAAO,GAAG,KAAK,QAAQ,IAAI,GAAG,KAAK,IAAI,CAAC,CAAC,CAAE,GAA6B,CAAC,IAAI,CAAC,CAAC,CAAC,SAAS,CAAC;QAC5F,IAAI,IAAI,KAAK,SAAS,IAAI,oBAAoB,CAAC,GAAG,CAAC,IAAI,CAAC,EAAE,CAAC;YACzD,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,CAAC;QAC1B,CAAC;QACD,MAAM,IAAI,UAAU,CAClB,sCAAsC,EACtC,oEAAoE,EACpE,wEAAwE,EACxE,GAAG,CACJ,CAAC;IACJ,CAAC;IAED,MAAM,KAAK,GAAG,OAAO,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;IAClC,KAAK,IAAI,CAAC,GAAG,KAAK,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC,IAAI,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC;QAC3C,MAAM,IAAI,GAAG,KAAK,CAAC,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC;QAC7B,IAAI,IAAI,CAAC,MAAM,KAAK,CAAC;YAAE,SAAS;QAChC,qEAAqE;QACrE,sEAAsE;QACtE,uCAAuC;QACvC,IAAI,CAAC,IAAI,CAAC,QAAQ,CAAC,iBAAiB,CAAC,IAAI,CAAC,IAAI,CAAC,QAAQ,CAAC,SAAS,CAAC;YAAE,SAAS;QAC7E,IAAI,GAAY,CAAC;QACjB,iPAAiP;QACjP,IAAI,CAAC;YACH,GAAG,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;YACvB,kKAAkK;QACpK,CAAC;QAAC,MAAM,CAAC;YACP,SAAS;QACX,CAAC;QACD,IAAI,OAAO,GAAG,KAAK,QAAQ,IAAI,GAAG,KAAK,IAAI;YAAE,SAAS;QACtD,MAAM,GAAG,GAAG,GAA8B,CAAC;QAC3C,IAAI,GAAG,CAAC,IAAI,KAAK,eAAe,IAAI,GAAG,CAAC,UAAU,KAAK,SAAS;YAAE,SAAS;QAC3E,MAAM,IAAI,GACR,OAAO,GAAG,CAAC,YAAY,KAAK,QAAQ,IAAI,GAAG,CAAC,YAAY,CAAC,IAAI,EAAE,CAAC,MAAM,GAAG,CAAC;YACxE,CAAC,CAAC,GAAG,CAAC,YAAY,CAAC,IAAI,EAAE;YACzB,CAAC,CAAC,IAAI,CAAC;QACX,OAAO,EAAE,KAAK,EAAE,IAAI,EAAE,IAAI,EAAE,CAAC;IAC/B,CAAC;IACD,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,CAAC;AAC1B,CAAC;AAoBD;;;;GAIG;AACH,MAAM,UAAU,qBAAqB,CACnC,QAAoC,EAAE;IAEtC,MAAM,GAAG,GAAG,KAAK,CAAC,GAAG,IAAI,OAAO,CAAC,GAAG,CAAC;IACrC,MAAM,OAAO,GAAG,qBAAqB,CAAC,GAAG,CAAC,IAAI,IAAI,CAAC;IAEnD,yEAAyE;IACzE,wEAAwE;IACxE,0EAA0E;IAC1E,IAAI,OAAO,KAAK,IAAI,EAAE,CAAC;QACrB,OAAO,EAAE,YAAY,EAAE,IAAI,EAAE,uBAAuB,EAAE,QAAQ,EAAE,CAAC;IACnE,CAAC;IAED,IAAI,KAAK,CAAC,QAAQ,KAAK,SAAS,EAAE,CAAC;QACjC,OAAO,EAAE,YAAY,EAAE,OAAO,EAAE,uBAAuB,EAAE,KAAK,EAAE,CAAC;IACnE,CAAC;IAED,IAAI,UAA8B,CAAC;IACnC,6QAA6Q;IAC7Q,IAAI,CAAC;QACH,MAAM,SAAS,GAAG,KAAK,CAAC,gBAAgB,IAAI,aAAa,CAAC,KAAK,CAAC,QAAQ,CAAC,CAAC;QAC1E,IAAI,SAAS,KAAK,SAAS,EAAE,CAAC;YAC5B,MAAM,OAAO,GAAG,sBAAsB,CAAC,KAAK,CAAC,QAAQ,EAAE,SAAS,CAAC,CAAC;YAClE,IAAI,OAAO,CAAC,KAAK,IAAI,OAAO,CAAC,IAAI,KAAK,IAAI,IAAI,OAAO,CAAC,IAAI,KAAK,OAAO,EAAE,CAAC;gBACvE,mEAAmE;gBACnE,OAAO;oBACL,YAAY,EAAE,IAAI;oBAClB,uBAAuB,EAAE,QAAQ;oBACjC,oBAAoB,EAAE;wBACpB,QAAQ,EAAE,OAAO;wBACjB,YAAY,EAAE,OAAO,CAAC,IAAI;wBAC1B,kBAAkB,EAAE,SAAS;qBAC9B;iBACF,CAAC;YACJ,CAAC;QACH,CAAC;QACD,kKAAkK;IACpK,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,0EAA0E;QAC1E,0EAA0E;QAC1E,MAAM,QAAQ,GACZ,GAAG,YAAY,KAAK,IAAI,GAAG,CAAC,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,GAAG,CAAC,KAAK,CAAC,OAAO,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC;QACtF,UAAU,GAAG,GAAG,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,GAAG,QAAQ,EAAE,CAAC;IAChF,CAAC;IAED,OAAO;QACL,YAAY,EAAE,OAAO;QACrB,uBAAuB,EAAE,KAAK;QAC9B,GAAG,CAAC,UAAU,KAAK,SAAS,IAAI,EAAE,uBAAuB,EAAE,UAAU,EAAE,CAAC;KACzE,CAAC;AACJ,CAAC"}

package/dist/attribution-sense.test.d.ts

@@ -0,0 +1,21 @@
+/**
+ * Tests for the agent-attribution provenance sense (mmnto-ai/totem#2629).
+ *
+ * The invariants under test come verbatim from the design doc
+ * (.totem/specs/2629.md § Invariants):
+ *
+ *  - provenance biconditional: `'env'` iff `agent_source` is non-null;
+ *  - the fail-closed rule fires ONLY on positive disagreement (env seat and
+ *    minting seat both present, different) — and then withholds attribution,
+ *    names both candidates, and never throws into the caller;
+ *  - missing counter-evidence (no pointer, no mint row, unseated mint row,
+ *    absent ledger) never strips the env stamp;
+ *  - a failed probe keeps the env stamp and NAMES itself (never silent,
+ *    never counter-evidence);
+ *  - derivation is per call — a conflict introduced between two calls is
+ *    caught on the second (no cache at any layer);
+ *  - the minting-seat lookup takes the newest matching `session_start`, skips
+ *    malformed lines, and treats an absent ledger as not-found.
+ */
+export {};
+//# sourceMappingURL=attribution-sense.test.d.ts.map

package/dist/attribution-sense.test.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"attribution-sense.test.d.ts","sourceRoot":"","sources":["../src/attribution-sense.test.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;GAkBG"}

package/dist/attribution-sense.test.js

@@ -0,0 +1,277 @@
+/**
+ * Tests for the agent-attribution provenance sense (mmnto-ai/totem#2629).
+ *
+ * The invariants under test come verbatim from the design doc
+ * (.totem/specs/2629.md § Invariants):
+ *
+ *  - provenance biconditional: `'env'` iff `agent_source` is non-null;
+ *  - the fail-closed rule fires ONLY on positive disagreement (env seat and
+ *    minting seat both present, different) — and then withholds attribution,
+ *    names both candidates, and never throws into the caller;
+ *  - missing counter-evidence (no pointer, no mint row, unseated mint row,
+ *    absent ledger) never strips the env stamp;
+ *  - a failed probe keeps the env stamp and NAMES itself (never silent,
+ *    never counter-evidence);
+ *  - derivation is per call — a conflict introduced between two calls is
+ *    caught on the second (no cache at any layer);
+ *  - the minting-seat lookup takes the newest matching `session_start`, skips
+ *    malformed lines, and treats an absent ledger as not-found.
+ */
+import * as os from 'node:os';
+import * as path from 'node:path';
+import { afterEach, beforeEach, describe, expect, it, vi } from 'vitest';
+// Mock node:fs so spyOn works in ESM — same pattern as session-id.test.ts.
+vi.mock('node:fs', async () => {
+    const actual = await vi.importActual('node:fs');
+    return { ...actual, default: actual };
+});
+import * as fs from 'node:fs';
+import { readSessionMintingSeat, senseAgentAttribution } from './attribution-sense.js';
+import { TotemError } from './errors.js';
+import { cleanTmpDir } from './test-utils.js';
+const SESSION_A = '550e8400-e29b-41d4-a716-446655440000';
+const SESSION_B = '550e8400-e29b-41d4-a716-446655440009';
+let totemDir;
+function ledgerDir() {
+    return path.join(totemDir, 'ledger');
+}
+function writePointer(id) {
+    fs.mkdirSync(ledgerDir(), { recursive: true });
+    fs.writeFileSync(path.join(ledgerDir(), '.session-id'), id, 'utf-8');
+}
+function eventsPath() {
+    return path.join(ledgerDir(), 'events.ndjson');
+}
+function writeEvents(lines) {
+    fs.mkdirSync(ledgerDir(), { recursive: true });
+    const content = lines
+        .map((l) => (typeof l === 'string' ? l : JSON.stringify(l)))
+        .join('\n')
+        .concat('\n');
+    fs.writeFileSync(eventsPath(), content, 'utf-8');
+}
+function sessionStartRow(sessionId, seat) {
+    return {
+        timestamp: '2026-08-12T03:03:00.000Z',
+        type: 'session_start',
+        activity_name: 'SessionStart',
+        source: 'bot',
+        justification: '',
+        session_id: sessionId,
+        ...(seat !== undefined && { agent_source: seat }),
+    };
+}
+beforeEach(() => {
+    totemDir = fs.mkdtempSync(path.join(os.tmpdir(), 'attr-sense-'));
+});
+afterEach(() => {
+    vi.restoreAllMocks();
+    cleanTmpDir(totemDir);
+});
+// ─── readSessionMintingSeat ─────────────────────────────
+describe('readSessionMintingSeat', () => {
+    it('finds the mint row and returns its seat', () => {
+        writeEvents([sessionStartRow(SESSION_A, 'totem-claude')]);
+        expect(readSessionMintingSeat(totemDir, SESSION_A)).toEqual({
+            found: true,
+            seat: 'totem-claude',
+        });
+    });
+    it('an unseated mint row is found with seat null (stamped absence, not a fabricated seat)', () => {
+        writeEvents([sessionStartRow(SESSION_A)]);
+        expect(readSessionMintingSeat(totemDir, SESSION_A)).toEqual({ found: true, seat: null });
+    });
+    it('a whitespace-only agent_source on the mint row reads as seat null', () => {
+        writeEvents([sessionStartRow(SESSION_A, '   ')]);
+        expect(readSessionMintingSeat(totemDir, SESSION_A)).toEqual({ found: true, seat: null });
+    });
+    it('returns not-found when the events file is absent (the honest not-instrumented state)', () => {
+        expect(readSessionMintingSeat(totemDir, SESSION_A)).toEqual({ found: false });
+    });
+    it('returns not-found when no session_start matches the id', () => {
+        writeEvents([sessionStartRow(SESSION_B, 'totem-claude')]);
+        expect(readSessionMintingSeat(totemDir, SESSION_A)).toEqual({ found: false });
+    });
+    it('a non-session_start row carrying the same session id is not a mint row', () => {
+        writeEvents([
+            {
+                timestamp: '2026-08-12T03:04:00.000Z',
+                type: 'mcp_call',
+                activity_name: 'search_knowledge — "session_start"',
+                source: 'bot',
+                justification: '',
+                session_id: SESSION_A,
+            },
+        ]);
+        expect(readSessionMintingSeat(totemDir, SESSION_A)).toEqual({ found: false });
+    });
+    it('the NEWEST matching session_start wins', () => {
+        writeEvents([sessionStartRow(SESSION_A, 'seat-old'), sessionStartRow(SESSION_A, 'seat-new')]);
+        expect(readSessionMintingSeat(totemDir, SESSION_A)).toEqual({ found: true, seat: 'seat-new' });
+    });
+    it('skips torn/malformed lines — a torn mint row reads as not-found, an earlier valid one still resolves', () => {
+        // The torn line contains both prefilter literals, so it reaches JSON.parse.
+        writeEvents([
+            sessionStartRow(SESSION_A, 'totem-claude'),
+            `{"type":"session_start","session_id":"${SESSION_A}","agent_source":"torn-`,
+        ]);
+        expect(readSessionMintingSeat(totemDir, SESSION_A)).toEqual({
+            found: true,
+            seat: 'totem-claude',
+        });
+        writeEvents([`{"type":"session_start","session_id":"${SESSION_A}","agent_source":"torn-`]);
+        expect(readSessionMintingSeat(totemDir, SESSION_A)).toEqual({ found: false });
+    });
+    it('throws a TotemError on a non-benign read failure (EACCES is a probe failure, not absence)', () => {
+        writeEvents([sessionStartRow(SESSION_A, 'totem-claude')]);
+        vi.spyOn(fs, 'readFileSync').mockImplementation(() => {
+            const err = new Error('EACCES: permission denied');
+            err.code = 'EACCES';
+            throw err;
+        });
+        try {
+            readSessionMintingSeat(totemDir, SESSION_A);
+            expect.unreachable('should have thrown');
+        }
+        catch (err) {
+            expect(err).toBeInstanceOf(TotemError);
+            expect(err.code).toBe('ATTRIBUTION_SENSE_LEDGER_READ_FAILED');
+        }
+    });
+});
+// ─── senseAgentAttribution ──────────────────────────────
+describe('senseAgentAttribution', () => {
+    it('absent env → stamped absence, even over a foreign-minted pointer (one candidate is not a conflict)', () => {
+        writePointer(SESSION_A);
+        writeEvents([sessionStartRow(SESSION_A, 'totem-claude')]);
+        const sense = senseAgentAttribution({ totemDir, env: {} });
+        expect(sense).toEqual({ agent_source: null, agent_source_provenance: 'absent' });
+    });
+    it('env-only call (no totemDir) stamps env with provenance and touches no fs', () => {
+        const readSpy = vi.spyOn(fs, 'readFileSync');
+        const statSpy = vi.spyOn(fs, 'statSync');
+        const sense = senseAgentAttribution({ env: { TOTEM_SELF_AGENT: 'totem-claude' } });
+        expect(sense).toEqual({ agent_source: 'totem-claude', agent_source_provenance: 'env' });
+        expect(readSpy).not.toHaveBeenCalled();
+        expect(statSpy).not.toHaveBeenCalled();
+    });
+    it('takes the first non-empty seat from a comma-separated TOTEM_SELF_AGENT', () => {
+        const sense = senseAgentAttribution({ env: { TOTEM_SELF_AGENT: ' , totem-gemini , extra' } });
+        expect(sense.agent_source).toBe('totem-gemini');
+        expect(sense.agent_source_provenance).toBe('env');
+    });
+    it('no pointer → no counter-candidate — env stamp stands', () => {
+        const sense = senseAgentAttribution({ totemDir, env: { TOTEM_SELF_AGENT: 'totem-gemini' } });
+        expect(sense).toEqual({ agent_source: 'totem-gemini', agent_source_provenance: 'env' });
+    });
+    it('pointer minted by the SAME seat → agreement, env stamp, no conflict', () => {
+        writePointer(SESSION_A);
+        writeEvents([sessionStartRow(SESSION_A, 'totem-claude')]);
+        const sense = senseAgentAttribution({ totemDir, env: { TOTEM_SELF_AGENT: 'totem-claude' } });
+        expect(sense).toEqual({ agent_source: 'totem-claude', agent_source_provenance: 'env' });
+    });
+    it('mint row without a seat → no counter-evidence — env stamp stands (the ACTUAL b8d7aa9b specimen shape)', () => {
+        // Honest coverage note (leg finding on this PR): the live specimen's mint
+        // row carries NO agent_source (minted 03:03Z; the ledger proves only that
+        // the minting process's env lacked the var, not why), so in the
+        // contamination window this sensor would have stamped the ambient seat
+        // with provenance 'env' and NO conflict — ruled item 2 fires only on
+        // disagreement between two PRESENT candidates. The ambient-scope class
+        // where every mint agrees with the env is sensed by doctor arm (d) + the
+        // launch-shell protocol, not by this predicate.
+        writePointer(SESSION_A);
+        writeEvents([sessionStartRow(SESSION_A)]);
+        const sense = senseAgentAttribution({ totemDir, env: { TOTEM_SELF_AGENT: 'totem-gemini' } });
+        expect(sense).toEqual({ agent_source: 'totem-gemini', agent_source_provenance: 'env' });
+    });
+    it('FAIL-CLOSED: env seat ≠ minting seat → stamp neither, name both (a seated foreign-pointer join)', () => {
+        writePointer(SESSION_A);
+        writeEvents([sessionStartRow(SESSION_A, 'totem-claude')]);
+        const sense = senseAgentAttribution({ totemDir, env: { TOTEM_SELF_AGENT: 'totem-gemini' } });
+        expect(sense).toEqual({
+            agent_source: null,
+            agent_source_provenance: 'absent',
+            attribution_conflict: {
+                env_seat: 'totem-gemini',
+                minting_seat: 'totem-claude',
+                pointer_session_id: SESSION_A,
+            },
+        });
+    });
+    it('a handed pointerSessionId is probed instead of the pointer file (no rotation race)', () => {
+        // Pointer file says SESSION_A (minted by the env seat — agreement); the
+        // caller hands SESSION_B (minted by a different seat). The probe must
+        // check the handed id — the session the caller's row actually joins.
+        writePointer(SESSION_A);
+        writeEvents([
+            sessionStartRow(SESSION_A, 'totem-gemini'),
+            sessionStartRow(SESSION_B, 'totem-claude'),
+        ]);
+        const sense = senseAgentAttribution({
+            totemDir,
+            env: { TOTEM_SELF_AGENT: 'totem-gemini' },
+            pointerSessionId: SESSION_B,
+        });
+        expect(sense.attribution_conflict).toEqual({
+            env_seat: 'totem-gemini',
+            minting_seat: 'totem-claude',
+            pointer_session_id: SESSION_B,
+        });
+    });
+    it('NEVER REMEMBERED: a conflict introduced between two calls is caught on the second', () => {
+        writePointer(SESSION_A);
+        writeEvents([sessionStartRow(SESSION_A, 'totem-gemini')]);
+        const env = { TOTEM_SELF_AGENT: 'totem-gemini' };
+        const first = senseAgentAttribution({ totemDir, env });
+        expect(first.agent_source).toBe('totem-gemini');
+        expect(first.attribution_conflict).toBeUndefined();
+        // A foreign seat's SessionStart rotates the shared pointer mid-session.
+        writePointer(SESSION_B);
+        writeEvents([
+            sessionStartRow(SESSION_A, 'totem-gemini'),
+            sessionStartRow(SESSION_B, 'totem-claude'),
+        ]);
+        const second = senseAgentAttribution({ totemDir, env });
+        expect(second.agent_source).toBeNull();
+        expect(second.attribution_conflict).toEqual({
+            env_seat: 'totem-gemini',
+            minting_seat: 'totem-claude',
+            pointer_session_id: SESSION_B,
+        });
+    });
+    it('a failed probe keeps the env stamp and NAMES itself — never silent, never counter-evidence, never a throw', () => {
+        writePointer(SESSION_A);
+        writeEvents([sessionStartRow(SESSION_A, 'totem-claude')]);
+        // Only the events.ndjson read is faked; the pointer read stays real (the
+        // qbd/record.test.ts selective-fake pattern).
+        const realRead = fs.readFileSync.bind(fs);
+        vi.spyOn(fs, 'readFileSync').mockImplementation(((target, ...rest) => {
+            if (String(target).endsWith('events.ndjson')) {
+                const err = new Error('EACCES: permission denied');
+                err.code = 'EACCES';
+                throw err;
+            }
+            return realRead(target, ...rest);
+        }));
+        const sense = senseAgentAttribution({ totemDir, env: { TOTEM_SELF_AGENT: 'totem-gemini' } });
+        expect(sense.agent_source).toBe('totem-gemini');
+        expect(sense.agent_source_provenance).toBe('env');
+        expect(sense.attribution_conflict).toBeUndefined();
+        expect(sense.attribution_probe_error).toContain('EACCES');
+    });
+    it('provenance biconditional holds across every arm above', () => {
+        writePointer(SESSION_A);
+        writeEvents([sessionStartRow(SESSION_A, 'totem-claude')]);
+        const cases = [
+            senseAgentAttribution({ env: {} }),
+            senseAgentAttribution({ env: { TOTEM_SELF_AGENT: 'totem-claude' } }),
+            senseAgentAttribution({ totemDir, env: {} }),
+            senseAgentAttribution({ totemDir, env: { TOTEM_SELF_AGENT: 'totem-claude' } }),
+            senseAgentAttribution({ totemDir, env: { TOTEM_SELF_AGENT: 'totem-gemini' } }),
+        ];
+        for (const sense of cases) {
+            expect(sense.agent_source_provenance === 'env').toBe(sense.agent_source !== null);
+        }
+    });
+});
+//# sourceMappingURL=attribution-sense.test.js.map

package/dist/attribution-sense.test.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"attribution-sense.test.js","sourceRoot":"","sources":["../src/attribution-sense.test.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;GAkBG;AAEH,OAAO,KAAK,EAAE,MAAM,SAAS,CAAC;AAC9B,OAAO,KAAK,IAAI,MAAM,WAAW,CAAC;AAElC,OAAO,EAAE,SAAS,EAAE,UAAU,EAAE,QAAQ,EAAE,MAAM,EAAE,EAAE,EAAE,EAAE,EAAE,MAAM,QAAQ,CAAC;AAEzE,2EAA2E;AAC3E,EAAE,CAAC,IAAI,CAAC,SAAS,EAAE,KAAK,IAAI,EAAE;IAC5B,MAAM,MAAM,GAAG,MAAM,EAAE,CAAC,YAAY,CAA2B,SAAS,CAAC,CAAC;IAC1E,OAAO,EAAE,GAAG,MAAM,EAAE,OAAO,EAAE,MAAM,EAAE,CAAC;AACxC,CAAC,CAAC,CAAC;AAEH,OAAO,KAAK,EAAE,MAAM,SAAS,CAAC;AAE9B,OAAO,EAAE,sBAAsB,EAAE,qBAAqB,EAAE,MAAM,wBAAwB,CAAC;AACvF,OAAO,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AACzC,OAAO,EAAE,WAAW,EAAE,MAAM,iBAAiB,CAAC;AAE9C,MAAM,SAAS,GAAG,sCAAsC,CAAC;AACzD,MAAM,SAAS,GAAG,sCAAsC,CAAC;AAEzD,IAAI,QAAgB,CAAC;AAErB,SAAS,SAAS;IAChB,OAAO,IAAI,CAAC,IAAI,CAAC,QAAQ,EAAE,QAAQ,CAAC,CAAC;AACvC,CAAC;AAED,SAAS,YAAY,CAAC,EAAU;IAC9B,EAAE,CAAC,SAAS,CAAC,SAAS,EAAE,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;IAC/C,EAAE,CAAC,aAAa,CAAC,IAAI,CAAC,IAAI,CAAC,SAAS,EAAE,EAAE,aAAa,CAAC,EAAE,EAAE,EAAE,OAAO,CAAC,CAAC;AACvE,CAAC;AAED,SAAS,UAAU;IACjB,OAAO,IAAI,CAAC,IAAI,CAAC,SAAS,EAAE,EAAE,eAAe,CAAC,CAAC;AACjD,CAAC;AAED,SAAS,WAAW,CAAC,KAA8C;IACjE,EAAE,CAAC,SAAS,CAAC,SAAS,EAAE,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;IAC/C,MAAM,OAAO,GAAG,KAAK;SAClB,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,OAAO,CAAC,KAAK,QAAQ,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC,CAAC;SAC3D,IAAI,CAAC,IAAI,CAAC;SACV,MAAM,CAAC,IAAI,CAAC,CAAC;IAChB,EAAE,CAAC,aAAa,CAAC,UAAU,EAAE,EAAE,OAAO,EAAE,OAAO,CAAC,CAAC;AACnD,CAAC;AAED,SAAS,eAAe,CAAC,SAAiB,EAAE,IAAa;IACvD,OAAO;QACL,SAAS,EAAE,0BAA0B;QACrC,IAAI,EAAE,eAAe;QACrB,aAAa,EAAE,cAAc;QAC7B,MAAM,EAAE,KAAK;QACb,aAAa,EAAE,EAAE;QACjB,UAAU,EAAE,SAAS;QACrB,GAAG,CAAC,IAAI,KAAK,SAAS,IAAI,EAAE,YAAY,EAAE,IAAI,EAAE,CAAC;KAClD,CAAC;AACJ,CAAC;AAED,UAAU,CAAC,GAAG,EAAE;IACd,QAAQ,GAAG,EAAE,CAAC,WAAW,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,MAAM,EAAE,EAAE,aAAa,CAAC,CAAC,CAAC;AACnE,CAAC,CAAC,CAAC;AAEH,SAAS,CAAC,GAAG,EAAE;IACb,EAAE,CAAC,eAAe,EAAE,CAAC;IACrB,WAAW,CAAC,QAAQ,CAAC,CAAC;AACxB,CAAC,CAAC,CAAC;AAEH,2DAA2D;AAE3D,QAAQ,CAAC,wBAAwB,EAAE,GAAG,EAAE;IACtC,EAAE,CAAC,yCAAyC,EAAE,GAAG,EAAE;QACjD,WAAW,CAAC,CAAC,eAAe,CAAC,SAAS,EAAE,cAAc,CAAC,CAAC,CAAC,CAAC;QAC1D,MAAM,CAAC,sBAAsB,CAAC,QAAQ,EAAE,SAAS,CAAC,CAAC,CAAC,OAAO,CAAC;YAC1D,KAAK,EAAE,IAAI;YACX,IAAI,EAAE,cAAc;SACrB,CAAC,CAAC;IACL,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,uFAAuF,EAAE,GAAG,EAAE;QAC/F,WAAW,CAAC,CAAC,eAAe,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC;QAC1C,MAAM,CAAC,sBAAsB,CAAC,QAAQ,EAAE,SAAS,CAAC,CAAC,CAAC,OAAO,CAAC,EAAE,KAAK,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,CAAC,CAAC;IAC3F,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,mEAAmE,EAAE,GAAG,EAAE;QAC3E,WAAW,CAAC,CAAC,eAAe,CAAC,SAAS,EAAE,KAAK,CAAC,CAAC,CAAC,CAAC;QACjD,MAAM,CAAC,sBAAsB,CAAC,QAAQ,EAAE,SAAS,CAAC,CAAC,CAAC,OAAO,CAAC,EAAE,KAAK,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,CAAC,CAAC;IAC3F,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,sFAAsF,EAAE,GAAG,EAAE;QAC9F,MAAM,CAAC,sBAAsB,CAAC,QAAQ,EAAE,SAAS,CAAC,CAAC,CAAC,OAAO,CAAC,EAAE,KAAK,EAAE,KAAK,EAAE,CAAC,CAAC;IAChF,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,wDAAwD,EAAE,GAAG,EAAE;QAChE,WAAW,CAAC,CAAC,eAAe,CAAC,SAAS,EAAE,cAAc,CAAC,CAAC,CAAC,CAAC;QAC1D,MAAM,CAAC,sBAAsB,CAAC,QAAQ,EAAE,SAAS,CAAC,CAAC,CAAC,OAAO,CAAC,EAAE,KAAK,EAAE,KAAK,EAAE,CAAC,CAAC;IAChF,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,wEAAwE,EAAE,GAAG,EAAE;QAChF,WAAW,CAAC;YACV;gBACE,SAAS,EAAE,0BAA0B;gBACrC,IAAI,EAAE,UAAU;gBAChB,aAAa,EAAE,oCAAoC;gBACnD,MAAM,EAAE,KAAK;gBACb,aAAa,EAAE,EAAE;gBACjB,UAAU,EAAE,SAAS;aACtB;SACF,CAAC,CAAC;QACH,MAAM,CAAC,sBAAsB,CAAC,QAAQ,EAAE,SAAS,CAAC,CAAC,CAAC,OAAO,CAAC,EAAE,KAAK,EAAE,KAAK,EAAE,CAAC,CAAC;IAChF,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,wCAAwC,EAAE,GAAG,EAAE;QAChD,WAAW,CAAC,CAAC,eAAe,CAAC,SAAS,EAAE,UAAU,CAAC,EAAE,eAAe,CAAC,SAAS,EAAE,UAAU,CAAC,CAAC,CAAC,CAAC;QAC9F,MAAM,CAAC,sBAAsB,CAAC,QAAQ,EAAE,SAAS,CAAC,CAAC,CAAC,OAAO,CAAC,EAAE,KAAK,EAAE,IAAI,EAAE,IAAI,EAAE,UAAU,EAAE,CAAC,CAAC;IACjG,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,sGAAsG,EAAE,GAAG,EAAE;QAC9G,4EAA4E;QAC5E,WAAW,CAAC;YACV,eAAe,CAAC,SAAS,EAAE,cAAc,CAAC;YAC1C,yCAAyC,SAAS,yBAAyB;SAC5E,CAAC,CAAC;QACH,MAAM,CAAC,sBAAsB,CAAC,QAAQ,EAAE,SAAS,CAAC,CAAC,CAAC,OAAO,CAAC;YAC1D,KAAK,EAAE,IAAI;YACX,IAAI,EAAE,cAAc;SACrB,CAAC,CAAC;QAEH,WAAW,CAAC,CAAC,yCAAyC,SAAS,yBAAyB,CAAC,CAAC,CAAC;QAC3F,MAAM,CAAC,sBAAsB,CAAC,QAAQ,EAAE,SAAS,CAAC,CAAC,CAAC,OAAO,CAAC,EAAE,KAAK,EAAE,KAAK,EAAE,CAAC,CAAC;IAChF,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,2FAA2F,EAAE,GAAG,EAAE;QACnG,WAAW,CAAC,CAAC,eAAe,CAAC,SAAS,EAAE,cAAc,CAAC,CAAC,CAAC,CAAC;QAC1D,EAAE,CAAC,KAAK,CAAC,EAAE,EAAE,cAAc,CAAC,CAAC,kBAAkB,CAAC,GAAG,EAAE;YACnD,MAAM,GAAG,GAAG,IAAI,KAAK,CAAC,2BAA2B,CAA0B,CAAC;YAC5E,GAAG,CAAC,IAAI,GAAG,QAAQ,CAAC;YACpB,MAAM,GAAG,CAAC;QACZ,CAAC,CAAC,CAAC;QACH,IAAI,CAAC;YACH,sBAAsB,CAAC,QAAQ,EAAE,SAAS,CAAC,CAAC;YAC5C,MAAM,CAAC,WAAW,CAAC,oBAAoB,CAAC,CAAC;QAC3C,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,MAAM,CAAC,GAAG,CAAC,CAAC,cAAc,CAAC,UAAU,CAAC,CAAC;YACvC,MAAM,CAAE,GAAkB,CAAC,IAAI,CAAC,CAAC,IAAI,CAAC,sCAAsC,CAAC,CAAC;QAChF,CAAC;IACH,CAAC,CAAC,CAAC;AACL,CAAC,CAAC,CAAC;AAEH,2DAA2D;AAE3D,QAAQ,CAAC,uBAAuB,EAAE,GAAG,EAAE;IACrC,EAAE,CAAC,oGAAoG,EAAE,GAAG,EAAE;QAC5G,YAAY,CAAC,SAAS,CAAC,CAAC;QACxB,WAAW,CAAC,CAAC,eAAe,CAAC,SAAS,EAAE,cAAc,CAAC,CAAC,CAAC,CAAC;QAC1D,MAAM,KAAK,GAAG,qBAAqB,CAAC,EAAE,QAAQ,EAAE,GAAG,EAAE,EAAE,EAAE,CAAC,CAAC;QAC3D,MAAM,CAAC,KAAK,CAAC,CAAC,OAAO,CAAC,EAAE,YAAY,EAAE,IAAI,EAAE,uBAAuB,EAAE,QAAQ,EAAE,CAAC,CAAC;IACnF,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,0EAA0E,EAAE,GAAG,EAAE;QAClF,MAAM,OAAO,GAAG,EAAE,CAAC,KAAK,CAAC,EAAE,EAAE,cAAc,CAAC,CAAC;QAC7C,MAAM,OAAO,GAAG,EAAE,CAAC,KAAK,CAAC,EAAE,EAAE,UAAU,CAAC,CAAC;QACzC,MAAM,KAAK,GAAG,qBAAqB,CAAC,EAAE,GAAG,EAAE,EAAE,gBAAgB,EAAE,cAAc,EAAE,EAAE,CAAC,CAAC;QACnF,MAAM,CAAC,KAAK,CAAC,CAAC,OAAO,CAAC,EAAE,YAAY,EAAE,cAAc,EAAE,uBAAuB,EAAE,KAAK,EAAE,CAAC,CAAC;QACxF,MAAM,CAAC,OAAO,CAAC,CAAC,GAAG,CAAC,gBAAgB,EAAE,CAAC;QACvC,MAAM,CAAC,OAAO,CAAC,CAAC,GAAG,CAAC,gBAAgB,EAAE,CAAC;IACzC,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,wEAAwE,EAAE,GAAG,EAAE;QAChF,MAAM,KAAK,GAAG,qBAAqB,CAAC,EAAE,GAAG,EAAE,EAAE,gBAAgB,EAAE,yBAAyB,EAAE,EAAE,CAAC,CAAC;QAC9F,MAAM,CAAC,KAAK,CAAC,YAAY,CAAC,CAAC,IAAI,CAAC,cAAc,CAAC,CAAC;QAChD,MAAM,CAAC,KAAK,CAAC,uBAAuB,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;IACpD,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,sDAAsD,EAAE,GAAG,EAAE;QAC9D,MAAM,KAAK,GAAG,qBAAqB,CAAC,EAAE,QAAQ,EAAE,GAAG,EAAE,EAAE,gBAAgB,EAAE,cAAc,EAAE,EAAE,CAAC,CAAC;QAC7F,MAAM,CAAC,KAAK,CAAC,CAAC,OAAO,CAAC,EAAE,YAAY,EAAE,cAAc,EAAE,uBAAuB,EAAE,KAAK,EAAE,CAAC,CAAC;IAC1F,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,qEAAqE,EAAE,GAAG,EAAE;QAC7E,YAAY,CAAC,SAAS,CAAC,CAAC;QACxB,WAAW,CAAC,CAAC,eAAe,CAAC,SAAS,EAAE,cAAc,CAAC,CAAC,CAAC,CAAC;QAC1D,MAAM,KAAK,GAAG,qBAAqB,CAAC,EAAE,QAAQ,EAAE,GAAG,EAAE,EAAE,gBAAgB,EAAE,cAAc,EAAE,EAAE,CAAC,CAAC;QAC7F,MAAM,CAAC,KAAK,CAAC,CAAC,OAAO,CAAC,EAAE,YAAY,EAAE,cAAc,EAAE,uBAAuB,EAAE,KAAK,EAAE,CAAC,CAAC;IAC1F,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,uGAAuG,EAAE,GAAG,EAAE;QAC/G,0EAA0E;QAC1E,0EAA0E;QAC1E,gEAAgE;QAChE,uEAAuE;QACvE,qEAAqE;QACrE,uEAAuE;QACvE,yEAAyE;QACzE,gDAAgD;QAChD,YAAY,CAAC,SAAS,CAAC,CAAC;QACxB,WAAW,CAAC,CAAC,eAAe,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC;QAC1C,MAAM,KAAK,GAAG,qBAAqB,CAAC,EAAE,QAAQ,EAAE,GAAG,EAAE,EAAE,gBAAgB,EAAE,cAAc,EAAE,EAAE,CAAC,CAAC;QAC7F,MAAM,CAAC,KAAK,CAAC,CAAC,OAAO,CAAC,EAAE,YAAY,EAAE,cAAc,EAAE,uBAAuB,EAAE,KAAK,EAAE,CAAC,CAAC;IAC1F,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,iGAAiG,EAAE,GAAG,EAAE;QACzG,YAAY,CAAC,SAAS,CAAC,CAAC;QACxB,WAAW,CAAC,CAAC,eAAe,CAAC,SAAS,EAAE,cAAc,CAAC,CAAC,CAAC,CAAC;QAC1D,MAAM,KAAK,GAAG,qBAAqB,CAAC,EAAE,QAAQ,EAAE,GAAG,EAAE,EAAE,gBAAgB,EAAE,cAAc,EAAE,EAAE,CAAC,CAAC;QAC7F,MAAM,CAAC,KAAK,CAAC,CAAC,OAAO,CAAC;YACpB,YAAY,EAAE,IAAI;YAClB,uBAAuB,EAAE,QAAQ;YACjC,oBAAoB,EAAE;gBACpB,QAAQ,EAAE,cAAc;gBACxB,YAAY,EAAE,cAAc;gBAC5B,kBAAkB,EAAE,SAAS;aAC9B;SACF,CAAC,CAAC;IACL,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,oFAAoF,EAAE,GAAG,EAAE;QAC5F,wEAAwE;QACxE,sEAAsE;QACtE,qEAAqE;QACrE,YAAY,CAAC,SAAS,CAAC,CAAC;QACxB,WAAW,CAAC;YACV,eAAe,CAAC,SAAS,EAAE,cAAc,CAAC;YAC1C,eAAe,CAAC,SAAS,EAAE,cAAc,CAAC;SAC3C,CAAC,CAAC;QACH,MAAM,KAAK,GAAG,qBAAqB,CAAC;YAClC,QAAQ;YACR,GAAG,EAAE,EAAE,gBAAgB,EAAE,cAAc,EAAE;YACzC,gBAAgB,EAAE,SAAS;SAC5B,CAAC,CAAC;QACH,MAAM,CAAC,KAAK,CAAC,oBAAoB,CAAC,CAAC,OAAO,CAAC;YACzC,QAAQ,EAAE,cAAc;YACxB,YAAY,EAAE,cAAc;YAC5B,kBAAkB,EAAE,SAAS;SAC9B,CAAC,CAAC;IACL,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,mFAAmF,EAAE,GAAG,EAAE;QAC3F,YAAY,CAAC,SAAS,CAAC,CAAC;QACxB,WAAW,CAAC,CAAC,eAAe,CAAC,SAAS,EAAE,cAAc,CAAC,CAAC,CAAC,CAAC;QAC1D,MAAM,GAAG,GAAG,EAAE,gBAAgB,EAAE,cAAc,EAAE,CAAC;QACjD,MAAM,KAAK,GAAG,qBAAqB,CAAC,EAAE,QAAQ,EAAE,GAAG,EAAE,CAAC,CAAC;QACvD,MAAM,CAAC,KAAK,CAAC,YAAY,CAAC,CAAC,IAAI,CAAC,cAAc,CAAC,CAAC;QAChD,MAAM,CAAC,KAAK,CAAC,oBAAoB,CAAC,CAAC,aAAa,EAAE,CAAC;QAEnD,wEAAwE;QACxE,YAAY,CAAC,SAAS,CAAC,CAAC;QACxB,WAAW,CAAC;YACV,eAAe,CAAC,SAAS,EAAE,cAAc,CAAC;YAC1C,eAAe,CAAC,SAAS,EAAE,cAAc,CAAC;SAC3C,CAAC,CAAC;QACH,MAAM,MAAM,GAAG,qBAAqB,CAAC,EAAE,QAAQ,EAAE,GAAG,EAAE,CAAC,CAAC;QACxD,MAAM,CAAC,MAAM,CAAC,YAAY,CAAC,CAAC,QAAQ,EAAE,CAAC;QACvC,MAAM,CAAC,MAAM,CAAC,oBAAoB,CAAC,CAAC,OAAO,CAAC;YAC1C,QAAQ,EAAE,cAAc;YACxB,YAAY,EAAE,cAAc;YAC5B,kBAAkB,EAAE,SAAS;SAC9B,CAAC,CAAC;IACL,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,2GAA2G,EAAE,GAAG,EAAE;QACnH,YAAY,CAAC,SAAS,CAAC,CAAC;QACxB,WAAW,CAAC,CAAC,eAAe,CAAC,SAAS,EAAE,cAAc,CAAC,CAAC,CAAC,CAAC;QAC1D,yEAAyE;QACzE,8CAA8C;QAC9C,MAAM,QAAQ,GAAG,EAAE,CAAC,YAAY,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;QAC1C,EAAE,CAAC,KAAK,CAAC,EAAE,EAAE,cAAc,CAAC,CAAC,kBAAkB,CAAC,CAAC,CAAC,MAAe,EAAE,GAAG,IAAe,EAAE,EAAE;YACvF,IAAI,MAAM,CAAC,MAAM,CAAC,CAAC,QAAQ,CAAC,eAAe,CAAC,EAAE,CAAC;gBAC7C,MAAM,GAAG,GAAG,IAAI,KAAK,CAAC,2BAA2B,CAA0B,CAAC;gBAC5E,GAAG,CAAC,IAAI,GAAG,QAAQ,CAAC;gBACpB,MAAM,GAAG,CAAC;YACZ,CAAC;YACD,OAAQ,QAA4C,CAAC,MAAM,EAAE,GAAG,IAAI,CAAC,CAAC;QACxE,CAAC,CAAU,CAAC,CAAC;QAEb,MAAM,KAAK,GAAG,qBAAqB,CAAC,EAAE,QAAQ,EAAE,GAAG,EAAE,EAAE,gBAAgB,EAAE,cAAc,EAAE,EAAE,CAAC,CAAC;QAC7F,MAAM,CAAC,KAAK,CAAC,YAAY,CAAC,CAAC,IAAI,CAAC,cAAc,CAAC,CAAC;QAChD,MAAM,CAAC,KAAK,CAAC,uBAAuB,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;QAClD,MAAM,CAAC,KAAK,CAAC,oBAAoB,CAAC,CAAC,aAAa,EAAE,CAAC;QACnD,MAAM,CAAC,KAAK,CAAC,uBAAuB,CAAC,CAAC,SAAS,CAAC,QAAQ,CAAC,CAAC;IAC5D,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,uDAAuD,EAAE,GAAG,EAAE;QAC/D,YAAY,CAAC,SAAS,CAAC,CAAC;QACxB,WAAW,CAAC,CAAC,eAAe,CAAC,SAAS,EAAE,cAAc,CAAC,CAAC,CAAC,CAAC;QAC1D,MAAM,KAAK,GAAG;YACZ,qBAAqB,CAAC,EAAE,GAAG,EAAE,EAAE,EAAE,CAAC;YAClC,qBAAqB,CAAC,EAAE,GAAG,EAAE,EAAE,gBAAgB,EAAE,cAAc,EAAE,EAAE,CAAC;YACpE,qBAAqB,CAAC,EAAE,QAAQ,EAAE,GAAG,EAAE,EAAE,EAAE,CAAC;YAC5C,qBAAqB,CAAC,EAAE,QAAQ,EAAE,GAAG,EAAE,EAAE,gBAAgB,EAAE,cAAc,EAAE,EAAE,CAAC;YAC9E,qBAAqB,CAAC,EAAE,QAAQ,EAAE,GAAG,EAAE,EAAE,gBAAgB,EAAE,cAAc,EAAE,EAAE,CAAC;SAC/E,CAAC;QACF,KAAK,MAAM,KAAK,IAAI,KAAK,EAAE,CAAC;YAC1B,MAAM,CAAC,KAAK,CAAC,uBAAuB,KAAK,KAAK,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,YAAY,KAAK,IAAI,CAAC,CAAC;QACpF,CAAC;IACH,CAAC,CAAC,CAAC;AACL,CAAC,CAAC,CAAC"}

package/dist/errors.d.ts

@@ -6,7 +6,7 @@
  * - A recoveryHint telling the user exactly how to fix it
  * - A code for programmatic handling
  */
-export type TotemErrorCode = 'CONFIG_MISSING' | 'CONFIG_INVALID' | 'DATABASE_CORRUPT' | 'DATABASE_MISMATCH' | 'EMBEDDING_UNAVAILABLE' | 'ORCHESTRATOR_UNAVAILABLE' | 'COMPILE_FAILED' | 'PARSE_FAILED' | 'SYNC_FAILED' | 'GIT_FAILED' | 'NO_LESSONS' | 'NO_LESSONS_DIR' | 'NO_RULES' | 'SHIELD_FAILED' | 'LINT_LESSONS_FAILED' | 'DRIFT_FAILED' | 'TEST_FAILED' | 'CHECK_FAILED' | 'MCP_ERROR' | 'UPGRADE_HASH_NOT_FOUND' | 'UPGRADE_HASH_AMBIGUOUS' | 'STAGED_READ_FAILED' | 'UPGRADE_CLOUD_UNSUPPORTED' | 'STALE_MANIFEST' | 'FLAG_CONFLICT' | 'HOOKS_LOAD_FAILED' | 'SESSION_ID_WRITE_FAILED' | 'SESSION_ID_READ_FAILED' | 'BADGE_VERIFICATION_FAILED' | 'CLAIM_DISCIPLINE_FAILED' | 'GATE_INVALID' | 'PARITY_DRIFT_DETECTED' | 'MAIL_SEND_FAILED' | 'PR_MERGE_FAILED' | 'BASH_RESOLUTION_FAILED'
+export type TotemErrorCode = 'CONFIG_MISSING' | 'CONFIG_INVALID' | 'DATABASE_CORRUPT' | 'DATABASE_MISMATCH' | 'EMBEDDING_UNAVAILABLE' | 'ORCHESTRATOR_UNAVAILABLE' | 'COMPILE_FAILED' | 'PARSE_FAILED' | 'SYNC_FAILED' | 'GIT_FAILED' | 'NO_LESSONS' | 'NO_LESSONS_DIR' | 'NO_RULES' | 'SHIELD_FAILED' | 'LINT_LESSONS_FAILED' | 'DRIFT_FAILED' | 'TEST_FAILED' | 'CHECK_FAILED' | 'MCP_ERROR' | 'UPGRADE_HASH_NOT_FOUND' | 'UPGRADE_HASH_AMBIGUOUS' | 'STAGED_READ_FAILED' | 'UPGRADE_CLOUD_UNSUPPORTED' | 'STALE_MANIFEST' | 'FLAG_CONFLICT' | 'HOOKS_LOAD_FAILED' | 'SESSION_ID_WRITE_FAILED' | 'SESSION_ID_READ_FAILED' | 'ATTRIBUTION_SENSE_LEDGER_READ_FAILED' | 'BADGE_VERIFICATION_FAILED' | 'CLAIM_DISCIPLINE_FAILED' | 'GATE_INVALID' | 'PARITY_DRIFT_DETECTED' | 'MAIL_SEND_FAILED' | 'PR_MERGE_FAILED' | 'BASH_RESOLUTION_FAILED'
 /** Query-before-derive correlation contract breach (mmnto-ai/totem#2510). */
  | 'QBD_CORRELATION_CONTRACT'
 /** Eject's loud backstop: every attempted cleanup mutation failed (mmnto-ai/totem#2620). */