@ornexus/neocortex 4.60.66 → 4.60.68

package/packages/client/dist/commands/mutation-qa-checkpoint.js

@@ -1,5 +1,285 @@
-import{createHash as b,randomUUID as J}from"node:crypto";import{closeSync as S,fsyncSync as w,lstatSync as h,mkdirSync as D,openSync as k,readFileSync as x,realpathSync as A,linkSync as I,unlinkSync as j,writeFileSync as P}from"node:fs";import{isAbsolute as F,join as y,resolve as q}from"node:path";import{mutationQaGit as g}from"./mutation-qa-git.js";import{planMutationQa as v}from"./mutation-qa.js";import{runMutationQa as H}from"./mutation-qa-run.js";function E(n,o){const e=q(n),r=g(e,["rev-parse","--show-toplevel"]).toString("utf8").trim(),t=g(e,["rev-parse","--git-common-dir"]).toString("utf8").trim(),a=F(t)?q(t):q(e,t);if(A(e)!==e||r!==e||A(a)!==a||h(a).isSymbolicLink()||h(a).uid!==process.getuid?.())throw new Error("mutation-qa-checkpoint-store-invalid");const i=y(a,"neocortex-mutation-qa");let c=!1;if(o&&!h(i,{throwIfNoEntry:!1}))try{D(i,{mode:448}),c=!0}catch(s){if(s.code!=="EEXIST")throw s}const d=h(i,{throwIfNoEntry:!1});if(d&&(!d.isDirectory()||d.isSymbolicLink()||d.uid!==process.getuid?.()||(d.mode&63)!==0))throw new Error("mutation-qa-checkpoint-store-invalid");if(c){const s=k(a,"r");try{w(s)}finally{S(s)}}return{root:e,directory:i}}function O(n){const o=h(n);if(!o.isFile()||o.isSymbolicLink()||o.uid!==process.getuid?.()||(o.mode&63)!==0||o.size<1||o.size>4096)throw new Error("mutation-qa-checkpoint-record-invalid");const e=x(n,"utf8");let r;try{r=JSON.parse(e)}catch{throw new Error("mutation-qa-checkpoint-record-invalid")}if(!r||typeof r!="object"||Array.isArray(r))throw new Error("mutation-qa-checkpoint-record-invalid");const t=r,{checksumSha256:a,...i}=t,c=b("sha256").update(`mutation-qa-checkpoint-v1\0${JSON.stringify(i)}`).digest("hex");if(Object.keys(t).sort().join(",")!==["schemaVersion","kind","planSha256","headSha","baseSha","reportSha256","verdict","mutationScore","checkpointAccepted","qaPassed","localOnly","checksumSha256"].sort().join(",")||t.schemaVersion!==1||t.kind!=="mutation-qa-checkpoint"||typeof t.planSha256!="string"||!/^[a-f0-9]{64}$/.test(t.planSha256)||typeof t.headSha!="string"||!/^[a-f0-9]{40,64}$/.test(t.headSha)||typeof t.baseSha!="string"||!/^[a-f0-9]{40,64}$/.test(t.baseSha)||typeof t.reportSha256!="string"||!/^[a-f0-9]{64}$/.test(t.reportSha256)||!["passed","warned","failed"].includes(String(t.verdict))||typeof t.mutationScore!="number"||!Number.isFinite(t.mutationScore)||t.mutationScore<0||t.mutationScore>100||t.checkpointAccepted!==!0||t.qaPassed!==(t.verdict==="passed")||t.localOnly!==!0||a!==c||e!==`${JSON.stringify(t)}
-`)throw new Error("mutation-qa-checkpoint-record-invalid");return t}function Q(n){const o=h(n);if(!o.isFile()||o.isSymbolicLink()||o.uid!==process.getuid?.()||(o.mode&63)!==0||o.size<1||o.size>4096)throw new Error("mutation-qa-debt-record-invalid");const e=x(n,"utf8");let r;try{r=JSON.parse(e)}catch{throw new Error("mutation-qa-debt-record-invalid")}if(!r||typeof r!="object"||Array.isArray(r))throw new Error("mutation-qa-debt-record-invalid");const t=r,{checksumSha256:a,...i}=t,c=b("sha256").update(`mutation-qa-debt-v1\0${JSON.stringify(i)}`).digest("hex");if(Object.keys(t).sort().join(",")!==["schemaVersion","kind","planSha256","headSha","status","reasonCode","runOutcome","owner","severity","publicSafe","localOnly","checksumSha256"].sort().join(",")||t.schemaVersion!==1||t.kind!=="mutation-qa-follow-up-debt"||typeof t.planSha256!="string"||!/^[a-f0-9]{64}$/.test(t.planSha256)||typeof t.headSha!="string"||!/^[a-f0-9]{40,64}$/.test(t.headSha)||!["warned","unobserved"].includes(String(t.status))||t.reasonCode!==(t.status==="warned"?"mutation-qa-warned":"mutation-qa-observation-missing")||!["not-run","skipped-no-files","skipped-stryker-missing","skipped-dependencies-unavailable","skipped-host-isolation-unavailable","skipped-stryker-error","verified"].includes(String(t.runOutcome))||t.owner!=="root-qa"||t.severity!==(t.status==="warned"?"P2":"P3")||t.publicSafe!==!0||t.localOnly!==!0||a!==c||e!==`${JSON.stringify(t)}
-`)throw new Error("mutation-qa-debt-record-invalid");return t}function B(n,o,e,r,t,a){const i=v(n,o);if(i.planSha256!==e)throw new Error("mutation-qa-debt-plan-drift");const c=V(n,o,e);if(r==="warned"&&(t!=="verified"||c?.verdict!=="warned"))throw new Error("mutation-qa-debt-run-invalid");if(r==="unobserved"&&(i.outcome!=="ready"||c||!["skipped-stryker-missing","skipped-dependencies-unavailable","skipped-stryker-error"].includes(t)))throw new Error("mutation-qa-debt-run-invalid");const{root:d,directory:s}=E(a??n,!0);if(a&&g(d,["rev-parse","--verify","HEAD"]).toString("utf8").trim()!==i.baseSha)throw new Error("mutation-qa-debt-root-drift");const l={schemaVersion:1,kind:"mutation-qa-follow-up-debt",planSha256:e,headSha:i.headSha,status:r,reasonCode:r==="warned"?"mutation-qa-warned":"mutation-qa-observation-missing",runOutcome:t,owner:"root-qa",severity:r==="warned"?"P2":"P3",publicSafe:!0,localOnly:!0},f=Object.freeze({...l,checksumSha256:b("sha256").update(`mutation-qa-debt-v1\0${JSON.stringify(l)}`).digest("hex")}),p=y(s,`debt-${e}.json`);if(h(p,{throwIfNoEntry:!1})){const m=Q(p);if(JSON.stringify(m)!==JSON.stringify(f))throw new Error("mutation-qa-debt-conflict");return m}const u=y(s,`debt-${J()}.tmp`);try{const m=k(u,"wx",384);try{P(m,`${JSON.stringify(f)}
-`),w(m)}finally{S(m)}if(v(n,o).planSha256!==e||a&&g(d,["rev-parse","--verify","HEAD"]).toString("utf8").trim()!==i.baseSha)throw new Error("mutation-qa-debt-plan-drift");try{I(u,p)}catch($){if($.code!=="EEXIST")throw $;const z=Q(p);if(JSON.stringify(z)!==JSON.stringify(f))throw new Error("mutation-qa-debt-conflict")}const N=k(s,"r");try{w(N)}finally{S(N)}}finally{h(u,{throwIfNoEntry:!1})&&j(u)}return f}function M(n,o,e){if(e.outcome!=="verified"||!e.verdict||e.verdict.planSha256!==e.planSha256||e.verdict.checkpointAccepted!==!1)throw new Error("mutation-qa-checkpoint-verdict-unavailable");const r=v(n,o);if(r.outcome!=="ready"||r.planSha256!==e.planSha256||r.headSha!==e.headSha)throw new Error("mutation-qa-checkpoint-plan-drift");const{root:t,directory:a}=E(n,!0),i={schemaVersion:1,kind:"mutation-qa-checkpoint",planSha256:r.planSha256,headSha:r.headSha,baseSha:r.baseSha,reportSha256:e.verdict.reportSha256,verdict:e.verdict.outcome,mutationScore:e.verdict.mutationScore,checkpointAccepted:!0,qaPassed:e.verdict.outcome==="passed",localOnly:!0},c=Object.freeze({...i,checksumSha256:b("sha256").update(`mutation-qa-checkpoint-v1\0${JSON.stringify(i)}`).digest("hex")}),d=y(a,`${r.planSha256}.json`);if(h(d,{throwIfNoEntry:!1})){const l=O(d);if(JSON.stringify(l)!==JSON.stringify(c))throw new Error("mutation-qa-checkpoint-conflict");return l}const s=y(a,`checkpoint-${J()}.tmp`);try{const l=k(s,"wx",384);try{P(l,`${JSON.stringify(c)}
-`),w(l)}finally{S(l)}if(v(t,o).planSha256!==r.planSha256)throw new Error("mutation-qa-checkpoint-plan-drift");try{I(s,d)}catch(p){if(p.code!=="EEXIST")throw p;const u=O(d);if(JSON.stringify(u)!==JSON.stringify(c))throw new Error("mutation-qa-checkpoint-conflict")}const f=k(a,"r");try{w(f)}finally{S(f)}}finally{h(s,{throwIfNoEntry:!1})&&j(s)}return c}function K(n,o,e){const r=H(n,o,e);return r.outcome==="verified"?{result:r,checkpoint:M(n,o,r)}:{result:r}}function V(n,o,e){if(!/^[a-f0-9]{64}$/.test(e))throw new Error("mutation-qa-plan-digest-invalid");const r=v(n,o);if(r.planSha256!==e)throw new Error("mutation-qa-checkpoint-plan-drift");const{directory:t}=E(n,!1),a=y(t,`${e}.json`);if(!h(a,{throwIfNoEntry:!1}))return;const i=O(a);if(i.planSha256!==e||i.headSha!==r.headSha||i.baseSha!==r.baseSha)throw new Error("mutation-qa-checkpoint-plan-drift");return i}export{V as readMutationQaCheckpoint,B as recordMutationQaFollowUpDebt,K as runAndRecordMutationQa};
+/** Root-owned, private observation of one physically executed mutation QA plan. */
+import { createHash, randomUUID } from 'node:crypto';
+import { closeSync, fsyncSync, lstatSync, mkdirSync, openSync, readFileSync, realpathSync, linkSync, unlinkSync, writeFileSync } from 'node:fs';
+import { isAbsolute, join, resolve } from 'node:path';
+import { mutationQaGit } from './mutation-qa-git.js';
+import { planMutationQa } from './mutation-qa.js';
+import { runMutationQa } from './mutation-qa-run.js';
+function context(projectRoot, create) {
+    const root = resolve(projectRoot);
+    const top = mutationQaGit(root, ['rev-parse', '--show-toplevel']).toString('utf8').trim();
+    const raw = mutationQaGit(root, ['rev-parse', '--git-common-dir']).toString('utf8').trim();
+    const common = isAbsolute(raw) ? resolve(raw) : resolve(root, raw);
+    if (realpathSync(root) !== root || top !== root || realpathSync(common) !== common
+        || lstatSync(common).isSymbolicLink() || lstatSync(common).uid !== process.getuid?.()) {
+        throw new Error('mutation-qa-checkpoint-store-invalid');
+    }
+    const directory = join(common, 'neocortex-mutation-qa');
+    let created = false;
+    if (create && !lstatSync(directory, { throwIfNoEntry: false })) {
+        try {
+            mkdirSync(directory, { mode: 0o700 });
+            created = true;
+        }
+        catch (error) {
+            if (error.code !== 'EEXIST')
+                throw error;
+        }
+    }
+    const stat = lstatSync(directory, { throwIfNoEntry: false });
+    if (stat) {
+        if (!stat.isDirectory() || stat.isSymbolicLink() || stat.uid !== process.getuid?.()
+            || (stat.mode & 0o077) !== 0)
+            throw new Error('mutation-qa-checkpoint-store-invalid');
+    }
+    if (created) {
+        const commonHandle = openSync(common, 'r');
+        try {
+            fsyncSync(commonHandle);
+        }
+        finally {
+            closeSync(commonHandle);
+        }
+    }
+    return { root, directory };
+}
+function checkedRecord(path) {
+    const stat = lstatSync(path);
+    if (!stat.isFile() || stat.isSymbolicLink() || stat.uid !== process.getuid?.()
+        || (stat.mode & 0o077) !== 0 || stat.size < 1 || stat.size > 4096) {
+        throw new Error('mutation-qa-checkpoint-record-invalid');
+    }
+    const raw = readFileSync(path, 'utf8');
+    let parsed;
+    try {
+        parsed = JSON.parse(raw);
+    }
+    catch {
+        throw new Error('mutation-qa-checkpoint-record-invalid');
+    }
+    if (!parsed || typeof parsed !== 'object' || Array.isArray(parsed)) {
+        throw new Error('mutation-qa-checkpoint-record-invalid');
+    }
+    const record = parsed;
+    const { checksumSha256, ...payload } = record;
+    const expected = createHash('sha256').update(`mutation-qa-checkpoint-v1\0${JSON.stringify(payload)}`)
+        .digest('hex');
+    if (Object.keys(record).sort().join(',') !== [
+        'schemaVersion', 'kind', 'planSha256', 'headSha', 'baseSha', 'reportSha256',
+        'verdict', 'mutationScore', 'checkpointAccepted', 'qaPassed', 'localOnly', 'checksumSha256',
+    ].sort().join(',') || record.schemaVersion !== 1 || record.kind !== 'mutation-qa-checkpoint'
+        || typeof record.planSha256 !== 'string' || !/^[a-f0-9]{64}$/.test(record.planSha256)
+        || typeof record.headSha !== 'string' || !/^[a-f0-9]{40,64}$/.test(record.headSha)
+        || typeof record.baseSha !== 'string' || !/^[a-f0-9]{40,64}$/.test(record.baseSha)
+        || typeof record.reportSha256 !== 'string' || !/^[a-f0-9]{64}$/.test(record.reportSha256)
+        || !['passed', 'warned', 'failed'].includes(String(record.verdict))
+        || typeof record.mutationScore !== 'number' || !Number.isFinite(record.mutationScore)
+        || record.mutationScore < 0 || record.mutationScore > 100
+        || record.checkpointAccepted !== true || record.qaPassed !== (record.verdict === 'passed')
+        || record.localOnly !== true || checksumSha256 !== expected
+        || raw !== `${JSON.stringify(record)}\n`) {
+        throw new Error('mutation-qa-checkpoint-record-invalid');
+    }
+    return record;
+}
+function checkedDebt(path) {
+    const stat = lstatSync(path);
+    if (!stat.isFile() || stat.isSymbolicLink() || stat.uid !== process.getuid?.()
+        || (stat.mode & 0o077) !== 0 || stat.size < 1 || stat.size > 4096) {
+        throw new Error('mutation-qa-debt-record-invalid');
+    }
+    const raw = readFileSync(path, 'utf8');
+    let parsed;
+    try {
+        parsed = JSON.parse(raw);
+    }
+    catch {
+        throw new Error('mutation-qa-debt-record-invalid');
+    }
+    if (!parsed || typeof parsed !== 'object' || Array.isArray(parsed)) {
+        throw new Error('mutation-qa-debt-record-invalid');
+    }
+    const record = parsed;
+    const { checksumSha256, ...payload } = record;
+    const expected = createHash('sha256').update(`mutation-qa-debt-v1\0${JSON.stringify(payload)}`).digest('hex');
+    if (Object.keys(record).sort().join(',') !== [
+        'schemaVersion', 'kind', 'planSha256', 'headSha', 'status', 'reasonCode',
+        'runOutcome', 'owner', 'severity', 'publicSafe', 'localOnly', 'checksumSha256',
+    ].sort().join(',') || record.schemaVersion !== 1 || record.kind !== 'mutation-qa-follow-up-debt'
+        || typeof record.planSha256 !== 'string' || !/^[a-f0-9]{64}$/.test(record.planSha256)
+        || typeof record.headSha !== 'string' || !/^[a-f0-9]{40,64}$/.test(record.headSha)
+        || !['warned', 'unobserved'].includes(String(record.status))
+        || record.reasonCode !== (record.status === 'warned'
+            ? 'mutation-qa-warned' : 'mutation-qa-observation-missing')
+        || !['not-run', 'skipped-no-files', 'skipped-stryker-missing',
+            'skipped-dependencies-unavailable', 'skipped-host-isolation-unavailable',
+            'skipped-stryker-error', 'verified'].includes(String(record.runOutcome))
+        || record.owner !== 'root-qa'
+        || record.severity !== (record.status === 'warned' ? 'P2' : 'P3')
+        || record.publicSafe !== true || record.localOnly !== true
+        || checksumSha256 !== expected || raw !== `${JSON.stringify(record)}\n`) {
+        throw new Error('mutation-qa-debt-record-invalid');
+    }
+    return record;
+}
+/** Persist optional-QA debt separately from the verdict before allowing root continuation. */
+export function recordMutationQaFollowUpDebt(projectRoot, baseRef, planSha256, status, runOutcome, durableRoot) {
+    const plan = planMutationQa(projectRoot, baseRef);
+    if (plan.planSha256 !== planSha256)
+        throw new Error('mutation-qa-debt-plan-drift');
+    const checkpoint = readMutationQaCheckpoint(projectRoot, baseRef, planSha256);
+    if (status === 'warned' && (runOutcome !== 'verified' || checkpoint?.verdict !== 'warned')) {
+        throw new Error('mutation-qa-debt-run-invalid');
+    }
+    if (status === 'unobserved' && (plan.outcome !== 'ready' || checkpoint
+        || !['skipped-stryker-missing', 'skipped-dependencies-unavailable',
+            'skipped-stryker-error'].includes(runOutcome))) {
+        throw new Error('mutation-qa-debt-run-invalid');
+    }
+    const { root, directory } = context(durableRoot ?? projectRoot, true);
+    if (durableRoot && mutationQaGit(root, ['rev-parse', '--verify', 'HEAD'])
+        .toString('utf8').trim() !== plan.baseSha) {
+        throw new Error('mutation-qa-debt-root-drift');
+    }
+    const payload = { schemaVersion: 1, kind: 'mutation-qa-follow-up-debt',
+        planSha256, headSha: plan.headSha, status,
+        reasonCode: status === 'warned' ? 'mutation-qa-warned'
+            : 'mutation-qa-observation-missing',
+        runOutcome, owner: 'root-qa',
+        severity: status === 'warned' ? 'P2' : 'P3',
+        publicSafe: true, localOnly: true };
+    const record = Object.freeze({ ...payload, checksumSha256: createHash('sha256')
+            .update(`mutation-qa-debt-v1\0${JSON.stringify(payload)}`).digest('hex') });
+    const target = join(directory, `debt-${planSha256}.json`);
+    if (lstatSync(target, { throwIfNoEntry: false })) {
+        const previous = checkedDebt(target);
+        if (JSON.stringify(previous) !== JSON.stringify(record))
+            throw new Error('mutation-qa-debt-conflict');
+        return previous;
+    }
+    const temporary = join(directory, `debt-${randomUUID()}.tmp`);
+    try {
+        const handle = openSync(temporary, 'wx', 0o600);
+        try {
+            writeFileSync(handle, `${JSON.stringify(record)}\n`);
+            fsyncSync(handle);
+        }
+        finally {
+            closeSync(handle);
+        }
+        if (planMutationQa(projectRoot, baseRef).planSha256 !== planSha256
+            || (durableRoot && mutationQaGit(root, ['rev-parse', '--verify', 'HEAD'])
+                .toString('utf8').trim() !== plan.baseSha)) {
+            throw new Error('mutation-qa-debt-plan-drift');
+        }
+        try {
+            linkSync(temporary, target);
+        }
+        catch (error) {
+            if (error.code !== 'EEXIST')
+                throw error;
+            const previous = checkedDebt(target);
+            if (JSON.stringify(previous) !== JSON.stringify(record))
+                throw new Error('mutation-qa-debt-conflict');
+        }
+        const directoryHandle = openSync(directory, 'r');
+        try {
+            fsyncSync(directoryHandle);
+        }
+        finally {
+            closeSync(directoryHandle);
+        }
+    }
+    finally {
+        if (lstatSync(temporary, { throwIfNoEntry: false }))
+            unlinkSync(temporary);
+    }
+    return record;
+}
+function recordMutationQaCheckpoint(projectRoot, baseRef, run) {
+    if (run.outcome !== 'verified' || !run.verdict
+        || run.verdict.planSha256 !== run.planSha256 || run.verdict.checkpointAccepted !== false) {
+        throw new Error('mutation-qa-checkpoint-verdict-unavailable');
+    }
+    const plan = planMutationQa(projectRoot, baseRef);
+    if (plan.outcome !== 'ready' || plan.planSha256 !== run.planSha256
+        || plan.headSha !== run.headSha)
+        throw new Error('mutation-qa-checkpoint-plan-drift');
+    const { root, directory } = context(projectRoot, true);
+    const payload = { schemaVersion: 1, kind: 'mutation-qa-checkpoint',
+        planSha256: plan.planSha256, headSha: plan.headSha, baseSha: plan.baseSha,
+        reportSha256: run.verdict.reportSha256, verdict: run.verdict.outcome,
+        mutationScore: run.verdict.mutationScore, checkpointAccepted: true,
+        qaPassed: run.verdict.outcome === 'passed', localOnly: true };
+    const record = Object.freeze({ ...payload, checksumSha256: createHash('sha256')
+            .update(`mutation-qa-checkpoint-v1\0${JSON.stringify(payload)}`).digest('hex') });
+    const target = join(directory, `${plan.planSha256}.json`);
+    if (lstatSync(target, { throwIfNoEntry: false })) {
+        const previous = checkedRecord(target);
+        if (JSON.stringify(previous) !== JSON.stringify(record)) {
+            throw new Error('mutation-qa-checkpoint-conflict');
+        }
+        return previous;
+    }
+    const temporary = join(directory, `checkpoint-${randomUUID()}.tmp`);
+    try {
+        const handle = openSync(temporary, 'wx', 0o600);
+        try {
+            writeFileSync(handle, `${JSON.stringify(record)}\n`);
+            fsyncSync(handle);
+        }
+        finally {
+            closeSync(handle);
+        }
+        if (planMutationQa(root, baseRef).planSha256 !== plan.planSha256) {
+            throw new Error('mutation-qa-checkpoint-plan-drift');
+        }
+        try {
+            linkSync(temporary, target);
+        }
+        catch (error) {
+            if (error.code !== 'EEXIST')
+                throw error;
+            const previous = checkedRecord(target);
+            if (JSON.stringify(previous) !== JSON.stringify(record)) {
+                throw new Error('mutation-qa-checkpoint-conflict');
+            }
+        }
+        const directoryHandle = openSync(directory, 'r');
+        try {
+            fsyncSync(directoryHandle);
+        }
+        finally {
+            closeSync(directoryHandle);
+        }
+    }
+    finally {
+        if (lstatSync(temporary, { throwIfNoEntry: false }))
+            unlinkSync(temporary);
+    }
+    return record;
+}
+/** An authorized root run is the only producer; skips never create a checkpoint. */
+export function runAndRecordMutationQa(projectRoot, baseRef, planSha256) {
+    const result = runMutationQa(projectRoot, baseRef, planSha256);
+    return result.outcome === 'verified'
+        ? { result, checkpoint: recordMutationQaCheckpoint(projectRoot, baseRef, result) }
+        : { result };
+}
+/** Revalidate the exact physical plan before projecting a private checkpoint. */
+export function readMutationQaCheckpoint(projectRoot, baseRef, planSha256) {
+    if (!/^[a-f0-9]{64}$/.test(planSha256))
+        throw new Error('mutation-qa-plan-digest-invalid');
+    const plan = planMutationQa(projectRoot, baseRef);
+    if (plan.planSha256 !== planSha256)
+        throw new Error('mutation-qa-checkpoint-plan-drift');
+    const { directory } = context(projectRoot, false);
+    const target = join(directory, `${planSha256}.json`);
+    if (!lstatSync(target, { throwIfNoEntry: false }))
+        return undefined;
+    const record = checkedRecord(target);
+    if (record.planSha256 !== planSha256 || record.headSha !== plan.headSha
+        || record.baseSha !== plan.baseSha)
+        throw new Error('mutation-qa-checkpoint-plan-drift');
+    return record;
+}

package/packages/client/dist/commands/mutation-qa-gate.js

@@ -1 +1,54 @@
-import{readMutationQaCheckpoint as l,recordMutationQaFollowUpDebt as s,runAndRecordMutationQa as c}from"./mutation-qa-checkpoint.js";import{planMutationQa as u}from"./mutation-qa.js";function d(n,t,o){const i=u(n,t);if(i.planSha256!==o)throw new Error("mutation-qa-gate-plan-drift");const e=l(n,t,o);if(u(n,t).planSha256!==i.planSha256)throw new Error("mutation-qa-gate-plan-drift");const a=e?.verdict??(i.outcome==="skipped-no-files"?"not-applicable":"unobserved"),r=a==="passed"?"mutation-qa-passed":a==="warned"?"mutation-qa-warned":a==="failed"?"mutation-qa-failed":a==="not-applicable"?"mutation-qa-no-eligible-files":"mutation-qa-observation-missing";return Object.freeze({schemaVersion:1,kind:"mutation-qa-gate-decision",planSha256:i.planSha256,headSha:i.headSha,status:a,reasonCode:r,checkpointAccepted:e!==void 0,qaPassed:a==="passed",blocksLocalQa:a==="failed",followUpDebtRequired:a==="warned"||a==="unobserved",safeToContinueLocalQa:a==="passed"||a==="not-applicable",publicSafe:!0,localOnly:!0})}function f(n,t,o){const i=u(n,t);if(i.planSha256!==o)throw new Error("mutation-qa-plan-drift");const e=i.outcome==="ready"?c(n,t,o):void 0;if(e?.result.outcome==="skipped-host-isolation-unavailable")throw new Error("mutation-qa-host-isolation-unavailable");const a=d(n,t,o),r=a.followUpDebtRequired?s(n,t,o,a.status,e?.result.outcome??"not-run"):void 0;if(u(n,t).planSha256!==o)throw new Error("mutation-qa-root-execution-drift");return Object.freeze({schemaVersion:1,kind:"mutation-qa-root-execution",planSha256:o,headSha:i.headSha,runOutcome:e?.result.outcome??"not-run",decision:a,...e?.checkpoint?{checkpoint:e.checkpoint}:{},...r?{followUpDebt:r}:{},continuationAuthorized:a.safeToContinueLocalQa||!!r&&!a.blocksLocalQa,publicSafe:!0,localOnly:!0})}export{d as classifyMutationQaGate,f as executeMutationQaPlan};
+/** Root-only classification of a physically bound mutation observation. */
+import { readMutationQaCheckpoint, recordMutationQaFollowUpDebt, runAndRecordMutationQa } from './mutation-qa-checkpoint.js';
+import { planMutationQa } from './mutation-qa.js';
+/** A skip is never a passing verdict; the caller must persist required debt separately. */
+export function classifyMutationQaGate(projectRoot, baseRef, expectedPlanSha256) {
+    const plan = planMutationQa(projectRoot, baseRef);
+    if (plan.planSha256 !== expectedPlanSha256)
+        throw new Error('mutation-qa-gate-plan-drift');
+    const checkpoint = readMutationQaCheckpoint(projectRoot, baseRef, expectedPlanSha256);
+    if (planMutationQa(projectRoot, baseRef).planSha256 !== plan.planSha256) {
+        throw new Error('mutation-qa-gate-plan-drift');
+    }
+    const status = checkpoint?.verdict ?? (plan.outcome === 'skipped-no-files'
+        ? 'not-applicable' : 'unobserved');
+    const reasonCode = status === 'passed' ? 'mutation-qa-passed'
+        : status === 'warned' ? 'mutation-qa-warned'
+            : status === 'failed' ? 'mutation-qa-failed'
+                : status === 'not-applicable' ? 'mutation-qa-no-eligible-files'
+                    : 'mutation-qa-observation-missing';
+    return Object.freeze({ schemaVersion: 1, kind: 'mutation-qa-gate-decision',
+        planSha256: plan.planSha256, headSha: plan.headSha, status, reasonCode,
+        checkpointAccepted: checkpoint !== undefined, qaPassed: status === 'passed',
+        blocksLocalQa: status === 'failed',
+        followUpDebtRequired: status === 'warned' || status === 'unobserved',
+        safeToContinueLocalQa: status === 'passed' || status === 'not-applicable',
+        publicSafe: true, localOnly: true });
+}
+/** One root transaction from a reviewed physical plan to verdict or durable debt. */
+export function executeMutationQaPlan(projectRoot, baseRef, expectedPlanSha256) {
+    const plan = planMutationQa(projectRoot, baseRef);
+    if (plan.planSha256 !== expectedPlanSha256)
+        throw new Error('mutation-qa-plan-drift');
+    const run = plan.outcome === 'ready'
+        ? runAndRecordMutationQa(projectRoot, baseRef, expectedPlanSha256)
+        : undefined;
+    if (run?.result.outcome === 'skipped-host-isolation-unavailable') {
+        throw new Error('mutation-qa-host-isolation-unavailable');
+    }
+    const decision = classifyMutationQaGate(projectRoot, baseRef, expectedPlanSha256);
+    const followUpDebt = decision.followUpDebtRequired
+        ? recordMutationQaFollowUpDebt(projectRoot, baseRef, expectedPlanSha256, decision.status, run?.result.outcome ?? 'not-run')
+        : undefined;
+    if (planMutationQa(projectRoot, baseRef).planSha256 !== expectedPlanSha256) {
+        throw new Error('mutation-qa-root-execution-drift');
+    }
+    return Object.freeze({ schemaVersion: 1, kind: 'mutation-qa-root-execution',
+        planSha256: expectedPlanSha256, headSha: plan.headSha,
+        runOutcome: run?.result.outcome ?? 'not-run', decision,
+        ...(run?.checkpoint ? { checkpoint: run.checkpoint } : {}),
+        ...(followUpDebt ? { followUpDebt } : {}),
+        continuationAuthorized: decision.safeToContinueLocalQa
+            || (!!followUpDebt && !decision.blocksLocalQa),
+        publicSafe: true, localOnly: true });
+}

package/packages/client/dist/commands/mutation-qa-git.js

@@ -1 +1,41 @@
-import{execFileSync as r}from"node:child_process";import{existsSync as i,lstatSync as n,realpathSync as s}from"node:fs";import{isAbsolute as c,join as u}from"node:path";function l(){for(const t of(process.env.PATH??"").split(":")){if(!c(t))continue;const e=u(t,"git");if(i(e)){try{const o=s(e);if((o.startsWith("/usr/")||o.startsWith("/home/linuxbrew/.linuxbrew/"))&&n(o).isFile())return o}catch{}break}}throw new Error("mutation-qa-git-untrusted")}function G(t,e){return r(l(),["-c","core.fsmonitor=false","-c","core.hooksPath=/dev/null","-c","protocol.ext.allow=never",...e],{cwd:t,env:{PATH:"/usr/bin:/bin",GIT_CONFIG_NOSYSTEM:"1",GIT_CONFIG_GLOBAL:"/dev/null",GIT_CONFIG_SYSTEM:"/dev/null",GIT_TERMINAL_PROMPT:"0",GIT_OPTIONAL_LOCKS:"0",GIT_LFS_SKIP_SMUDGE:"1"},stdio:["ignore","pipe","pipe"],timeout:15e3,maxBuffer:8*1024*1024})}export{G as mutationQaGit};
+/** Closed host Git boundary for root-owned mutation QA planning and clone setup. */
+import { execFileSync } from 'node:child_process';
+import { existsSync, lstatSync, realpathSync } from 'node:fs';
+import { isAbsolute, join } from 'node:path';
+function trustedGit() {
+    for (const directory of (process.env.PATH ?? '').split(':')) {
+        if (!isAbsolute(directory))
+            continue;
+        const candidate = join(directory, 'git');
+        if (!existsSync(candidate))
+            continue;
+        try {
+            const resolved = realpathSync(candidate);
+            if ((resolved.startsWith('/usr/') || resolved.startsWith('/home/linuxbrew/.linuxbrew/'))
+                && lstatSync(resolved).isFile())
+                return resolved;
+        }
+        catch { /* The first matching Git on PATH is untrusted. */ }
+        break;
+    }
+    throw new Error('mutation-qa-git-untrusted');
+}
+/** Exclude ambient Git configuration and executable shadowing; disable local hook/fsmonitor execution. */
+export function mutationQaGit(root, args) {
+    return execFileSync(trustedGit(), [
+        '-c', 'core.fsmonitor=false', '-c', 'core.hooksPath=/dev/null',
+        '-c', 'protocol.ext.allow=never', ...args,
+    ], {
+        cwd: root,
+        env: {
+            PATH: '/usr/bin:/bin',
+            GIT_CONFIG_NOSYSTEM: '1',
+            GIT_CONFIG_GLOBAL: '/dev/null',
+            GIT_CONFIG_SYSTEM: '/dev/null',
+            GIT_TERMINAL_PROMPT: '0',
+            GIT_OPTIONAL_LOCKS: '0',
+            GIT_LFS_SKIP_SMUDGE: '1',
+        },
+        stdio: ['ignore', 'pipe', 'pipe'], timeout: 15_000, maxBuffer: 8 * 1024 * 1024,
+    });
+}

package/packages/client/dist/commands/mutation-qa-policy.js

@@ -1 +1,102 @@
-import{createHash as m}from"node:crypto";import{lstatSync as y,readFileSync as b,realpathSync as w}from"node:fs";import{join as x}from"node:path";const g=Object.freeze({schema_version:1,default_threshold:75,block_threshold:50,exclude_paths:["**/*.test.ts","**/*.spec.ts","**/__tests__/**","**/migrations/**","**/*.d.ts"],per_area_threshold:{domain:90,infrastructure:60}}),h=16*1024;function c(e){return typeof e=="number"&&Number.isFinite(e)&&e>=0&&e<=100}function d(e){if(e.length===0||e.length>240||e.startsWith("/")||e.includes("..")||e.includes("//")||!/^[A-Za-z0-9_./*?-]+$/.test(e))throw new Error("mutation-qa-policy-pattern-invalid");let t="^";for(let o=0;o<e.length;o++){const s=e[o];s==="*"?e[o+1]==="*"?e[o+2]==="/"?(t+="(?:.*/)?",o+=2):(t+=".*",o++):t+="[^/]*":s==="?"?t+="[^/]":s==="/"?t+="/":t+=s.replace(/[.*+?^${}()|[\]\\]/g,"\\$&")}return new RegExp(`${t}$`)}function O(e,t){return e.excludePaths.some(o=>d(o).test(t))}function A(e){const t=x(e,".neocortex","mutation-policy.json");let o="default",s=Buffer.from(JSON.stringify(g));const n=y(t,{throwIfNoEntry:!1});if(n){if(w(t)!==t)throw new Error("mutation-qa-policy-path-unsafe");if(!n.isFile()||n.size===0||n.size>h)throw new Error("mutation-qa-policy-size-invalid");if(s=b(t),s.byteLength===0||s.byteLength>h)throw new Error("mutation-qa-policy-size-invalid");o="project"}let a;try{a=JSON.parse(s.toString("utf8").replace(/^\uFEFF/,""))}catch{throw new Error("mutation-qa-policy-invalid")}if(!a||typeof a!="object"||Array.isArray(a))throw new Error("mutation-qa-policy-invalid");const r=a,f=new Set(["$schema","_comment","schema_version","default_threshold","block_threshold","exclude_paths","per_area_threshold"]);if(Object.keys(r).some(i=>!f.has(i))||r.schema_version!==1||!c(r.default_threshold)||!c(r.block_threshold)||r.block_threshold>r.default_threshold||!Array.isArray(r.exclude_paths)||r.exclude_paths.length>32||r.exclude_paths.some(i=>typeof i!="string"))throw new Error("mutation-qa-policy-invalid");const u=r.exclude_paths.map(i=>(d(i),i)),l=r.per_area_threshold??{};if(!l||typeof l!="object"||Array.isArray(l)||Object.keys(l).length>32||Object.entries(l).some(([i,_])=>!/^[a-z][a-z0-9-]{0,63}$/.test(i)||!c(_)))throw new Error("mutation-qa-policy-invalid");const p=Object.freeze({...l});return Object.freeze({schemaVersion:1,source:o,sha256:m("sha256").update(s).digest("hex"),thresholds:Object.freeze({defaultThreshold:r.default_threshold,blockThreshold:r.block_threshold,perAreaThreshold:p}),excludePaths:Object.freeze(u)})}export{A as loadMutationQaPolicy,O as policyExcludesPath};
+/** Closed local mutation policy projection; never falls back from malformed project policy. */
+import { createHash } from 'node:crypto';
+import { lstatSync, readFileSync, realpathSync } from 'node:fs';
+import { join } from 'node:path';
+const DEFAULT_FIELDS = Object.freeze({ schema_version: 1, default_threshold: 75,
+    block_threshold: 50,
+    exclude_paths: ['**/*.test.ts', '**/*.spec.ts', '**/__tests__/**', '**/migrations/**', '**/*.d.ts'],
+    per_area_threshold: { domain: 90, infrastructure: 60 } });
+const MAX_POLICY_BYTES = 16 * 1024;
+function validScore(value) {
+    return typeof value === 'number' && Number.isFinite(value) && value >= 0 && value <= 100;
+}
+function globRegex(pattern) {
+    if (pattern.length === 0 || pattern.length > 240 || pattern.startsWith('/')
+        || pattern.includes('..') || pattern.includes('//')
+        || !/^[A-Za-z0-9_./*?-]+$/.test(pattern)) {
+        throw new Error('mutation-qa-policy-pattern-invalid');
+    }
+    let expression = '^';
+    for (let index = 0; index < pattern.length; index++) {
+        const current = pattern[index];
+        if (current === '*') {
+            if (pattern[index + 1] === '*') {
+                if (pattern[index + 2] === '/') {
+                    expression += '(?:.*/)?';
+                    index += 2;
+                }
+                else {
+                    expression += '.*';
+                    index++;
+                }
+            }
+            else
+                expression += '[^/]*';
+        }
+        else if (current === '?')
+            expression += '[^/]';
+        else if (current === '/')
+            expression += '/';
+        else
+            expression += current.replace(/[.*+?^${}()|[\]\\]/g, '\\$&');
+    }
+    return new RegExp(`${expression}$`);
+}
+export function policyExcludesPath(policy, path) {
+    return policy.excludePaths.some((pattern) => globRegex(pattern).test(path));
+}
+/** Accept a bounded subset of the published policy schema, failing closed on unknown semantics. */
+export function loadMutationQaPolicy(projectRoot) {
+    const path = join(projectRoot, '.neocortex', 'mutation-policy.json');
+    let source = 'default';
+    let raw = Buffer.from(JSON.stringify(DEFAULT_FIELDS));
+    const stat = lstatSync(path, { throwIfNoEntry: false });
+    if (stat) {
+        if (realpathSync(path) !== path)
+            throw new Error('mutation-qa-policy-path-unsafe');
+        if (!stat.isFile() || stat.size === 0 || stat.size > MAX_POLICY_BYTES) {
+            throw new Error('mutation-qa-policy-size-invalid');
+        }
+        raw = readFileSync(path);
+        if (raw.byteLength === 0 || raw.byteLength > MAX_POLICY_BYTES) {
+            throw new Error('mutation-qa-policy-size-invalid');
+        }
+        source = 'project';
+    }
+    let parsed;
+    try {
+        parsed = JSON.parse(raw.toString('utf8').replace(/^\uFEFF/, ''));
+    }
+    catch {
+        throw new Error('mutation-qa-policy-invalid');
+    }
+    if (!parsed || typeof parsed !== 'object' || Array.isArray(parsed)) {
+        throw new Error('mutation-qa-policy-invalid');
+    }
+    const policy = parsed;
+    const allowed = new Set(['$schema', '_comment', 'schema_version', 'default_threshold',
+        'block_threshold', 'exclude_paths', 'per_area_threshold']);
+    if (Object.keys(policy).some((key) => !allowed.has(key)) || policy.schema_version !== 1
+        || !validScore(policy.default_threshold) || !validScore(policy.block_threshold)
+        || policy.block_threshold > policy.default_threshold
+        || !Array.isArray(policy.exclude_paths) || policy.exclude_paths.length > 32
+        || policy.exclude_paths.some((entry) => typeof entry !== 'string')) {
+        throw new Error('mutation-qa-policy-invalid');
+    }
+    const exclusions = policy.exclude_paths.map((entry) => {
+        globRegex(entry);
+        return entry;
+    });
+    const areas = policy.per_area_threshold ?? {};
+    if (!areas || typeof areas !== 'object' || Array.isArray(areas)
+        || Object.keys(areas).length > 32
+        || Object.entries(areas).some(([key, value]) => !/^[a-z][a-z0-9-]{0,63}$/.test(key)
+            || !validScore(value)))
+        throw new Error('mutation-qa-policy-invalid');
+    const perAreaThreshold = Object.freeze({ ...areas });
+    return Object.freeze({ schemaVersion: 1, source,
+        sha256: createHash('sha256').update(raw).digest('hex'),
+        thresholds: Object.freeze({ defaultThreshold: policy.default_threshold,
+            blockThreshold: policy.block_threshold, perAreaThreshold }),
+        excludePaths: Object.freeze(exclusions), });
+}