@ornexus/neocortex 4.60.68 → 4.60.70

package/packages/client/dist/commands/mutation-qa-checkpoint.js

@@ -1,285 +1,5 @@
-/** Root-owned, private observation of one physically executed mutation QA plan. */
-import { createHash, randomUUID } from 'node:crypto';
-import { closeSync, fsyncSync, lstatSync, mkdirSync, openSync, readFileSync, realpathSync, linkSync, unlinkSync, writeFileSync } from 'node:fs';
-import { isAbsolute, join, resolve } from 'node:path';
-import { mutationQaGit } from './mutation-qa-git.js';
-import { planMutationQa } from './mutation-qa.js';
-import { runMutationQa } from './mutation-qa-run.js';
-function context(projectRoot, create) {
-    const root = resolve(projectRoot);
-    const top = mutationQaGit(root, ['rev-parse', '--show-toplevel']).toString('utf8').trim();
-    const raw = mutationQaGit(root, ['rev-parse', '--git-common-dir']).toString('utf8').trim();
-    const common = isAbsolute(raw) ? resolve(raw) : resolve(root, raw);
-    if (realpathSync(root) !== root || top !== root || realpathSync(common) !== common
-        || lstatSync(common).isSymbolicLink() || lstatSync(common).uid !== process.getuid?.()) {
-        throw new Error('mutation-qa-checkpoint-store-invalid');
-    }
-    const directory = join(common, 'neocortex-mutation-qa');
-    let created = false;
-    if (create && !lstatSync(directory, { throwIfNoEntry: false })) {
-        try {
-            mkdirSync(directory, { mode: 0o700 });
-            created = true;
-        }
-        catch (error) {
-            if (error.code !== 'EEXIST')
-                throw error;
-        }
-    }
-    const stat = lstatSync(directory, { throwIfNoEntry: false });
-    if (stat) {
-        if (!stat.isDirectory() || stat.isSymbolicLink() || stat.uid !== process.getuid?.()
-            || (stat.mode & 0o077) !== 0)
-            throw new Error('mutation-qa-checkpoint-store-invalid');
-    }
-    if (created) {
-        const commonHandle = openSync(common, 'r');
-        try {
-            fsyncSync(commonHandle);
-        }
-        finally {
-            closeSync(commonHandle);
-        }
-    }
-    return { root, directory };
-}
-function checkedRecord(path) {
-    const stat = lstatSync(path);
-    if (!stat.isFile() || stat.isSymbolicLink() || stat.uid !== process.getuid?.()
-        || (stat.mode & 0o077) !== 0 || stat.size < 1 || stat.size > 4096) {
-        throw new Error('mutation-qa-checkpoint-record-invalid');
-    }
-    const raw = readFileSync(path, 'utf8');
-    let parsed;
-    try {
-        parsed = JSON.parse(raw);
-    }
-    catch {
-        throw new Error('mutation-qa-checkpoint-record-invalid');
-    }
-    if (!parsed || typeof parsed !== 'object' || Array.isArray(parsed)) {
-        throw new Error('mutation-qa-checkpoint-record-invalid');
-    }
-    const record = parsed;
-    const { checksumSha256, ...payload } = record;
-    const expected = createHash('sha256').update(`mutation-qa-checkpoint-v1\0${JSON.stringify(payload)}`)
-        .digest('hex');
-    if (Object.keys(record).sort().join(',') !== [
-        'schemaVersion', 'kind', 'planSha256', 'headSha', 'baseSha', 'reportSha256',
-        'verdict', 'mutationScore', 'checkpointAccepted', 'qaPassed', 'localOnly', 'checksumSha256',
-    ].sort().join(',') || record.schemaVersion !== 1 || record.kind !== 'mutation-qa-checkpoint'
-        || typeof record.planSha256 !== 'string' || !/^[a-f0-9]{64}$/.test(record.planSha256)
-        || typeof record.headSha !== 'string' || !/^[a-f0-9]{40,64}$/.test(record.headSha)
-        || typeof record.baseSha !== 'string' || !/^[a-f0-9]{40,64}$/.test(record.baseSha)
-        || typeof record.reportSha256 !== 'string' || !/^[a-f0-9]{64}$/.test(record.reportSha256)
-        || !['passed', 'warned', 'failed'].includes(String(record.verdict))
-        || typeof record.mutationScore !== 'number' || !Number.isFinite(record.mutationScore)
-        || record.mutationScore < 0 || record.mutationScore > 100
-        || record.checkpointAccepted !== true || record.qaPassed !== (record.verdict === 'passed')
-        || record.localOnly !== true || checksumSha256 !== expected
-        || raw !== `${JSON.stringify(record)}\n`) {
-        throw new Error('mutation-qa-checkpoint-record-invalid');
-    }
-    return record;
-}
-function checkedDebt(path) {
-    const stat = lstatSync(path);
-    if (!stat.isFile() || stat.isSymbolicLink() || stat.uid !== process.getuid?.()
-        || (stat.mode & 0o077) !== 0 || stat.size < 1 || stat.size > 4096) {
-        throw new Error('mutation-qa-debt-record-invalid');
-    }
-    const raw = readFileSync(path, 'utf8');
-    let parsed;
-    try {
-        parsed = JSON.parse(raw);
-    }
-    catch {
-        throw new Error('mutation-qa-debt-record-invalid');
-    }
-    if (!parsed || typeof parsed !== 'object' || Array.isArray(parsed)) {
-        throw new Error('mutation-qa-debt-record-invalid');
-    }
-    const record = parsed;
-    const { checksumSha256, ...payload } = record;
-    const expected = createHash('sha256').update(`mutation-qa-debt-v1\0${JSON.stringify(payload)}`).digest('hex');
-    if (Object.keys(record).sort().join(',') !== [
-        'schemaVersion', 'kind', 'planSha256', 'headSha', 'status', 'reasonCode',
-        'runOutcome', 'owner', 'severity', 'publicSafe', 'localOnly', 'checksumSha256',
-    ].sort().join(',') || record.schemaVersion !== 1 || record.kind !== 'mutation-qa-follow-up-debt'
-        || typeof record.planSha256 !== 'string' || !/^[a-f0-9]{64}$/.test(record.planSha256)
-        || typeof record.headSha !== 'string' || !/^[a-f0-9]{40,64}$/.test(record.headSha)
-        || !['warned', 'unobserved'].includes(String(record.status))
-        || record.reasonCode !== (record.status === 'warned'
-            ? 'mutation-qa-warned' : 'mutation-qa-observation-missing')
-        || !['not-run', 'skipped-no-files', 'skipped-stryker-missing',
-            'skipped-dependencies-unavailable', 'skipped-host-isolation-unavailable',
-            'skipped-stryker-error', 'verified'].includes(String(record.runOutcome))
-        || record.owner !== 'root-qa'
-        || record.severity !== (record.status === 'warned' ? 'P2' : 'P3')
-        || record.publicSafe !== true || record.localOnly !== true
-        || checksumSha256 !== expected || raw !== `${JSON.stringify(record)}\n`) {
-        throw new Error('mutation-qa-debt-record-invalid');
-    }
-    return record;
-}
-/** Persist optional-QA debt separately from the verdict before allowing root continuation. */
-export function recordMutationQaFollowUpDebt(projectRoot, baseRef, planSha256, status, runOutcome, durableRoot) {
-    const plan = planMutationQa(projectRoot, baseRef);
-    if (plan.planSha256 !== planSha256)
-        throw new Error('mutation-qa-debt-plan-drift');
-    const checkpoint = readMutationQaCheckpoint(projectRoot, baseRef, planSha256);
-    if (status === 'warned' && (runOutcome !== 'verified' || checkpoint?.verdict !== 'warned')) {
-        throw new Error('mutation-qa-debt-run-invalid');
-    }
-    if (status === 'unobserved' && (plan.outcome !== 'ready' || checkpoint
-        || !['skipped-stryker-missing', 'skipped-dependencies-unavailable',
-            'skipped-stryker-error'].includes(runOutcome))) {
-        throw new Error('mutation-qa-debt-run-invalid');
-    }
-    const { root, directory } = context(durableRoot ?? projectRoot, true);
-    if (durableRoot && mutationQaGit(root, ['rev-parse', '--verify', 'HEAD'])
-        .toString('utf8').trim() !== plan.baseSha) {
-        throw new Error('mutation-qa-debt-root-drift');
-    }
-    const payload = { schemaVersion: 1, kind: 'mutation-qa-follow-up-debt',
-        planSha256, headSha: plan.headSha, status,
-        reasonCode: status === 'warned' ? 'mutation-qa-warned'
-            : 'mutation-qa-observation-missing',
-        runOutcome, owner: 'root-qa',
-        severity: status === 'warned' ? 'P2' : 'P3',
-        publicSafe: true, localOnly: true };
-    const record = Object.freeze({ ...payload, checksumSha256: createHash('sha256')
-            .update(`mutation-qa-debt-v1\0${JSON.stringify(payload)}`).digest('hex') });
-    const target = join(directory, `debt-${planSha256}.json`);
-    if (lstatSync(target, { throwIfNoEntry: false })) {
-        const previous = checkedDebt(target);
-        if (JSON.stringify(previous) !== JSON.stringify(record))
-            throw new Error('mutation-qa-debt-conflict');
-        return previous;
-    }
-    const temporary = join(directory, `debt-${randomUUID()}.tmp`);
-    try {
-        const handle = openSync(temporary, 'wx', 0o600);
-        try {
-            writeFileSync(handle, `${JSON.stringify(record)}\n`);
-            fsyncSync(handle);
-        }
-        finally {
-            closeSync(handle);
-        }
-        if (planMutationQa(projectRoot, baseRef).planSha256 !== planSha256
-            || (durableRoot && mutationQaGit(root, ['rev-parse', '--verify', 'HEAD'])
-                .toString('utf8').trim() !== plan.baseSha)) {
-            throw new Error('mutation-qa-debt-plan-drift');
-        }
-        try {
-            linkSync(temporary, target);
-        }
-        catch (error) {
-            if (error.code !== 'EEXIST')
-                throw error;
-            const previous = checkedDebt(target);
-            if (JSON.stringify(previous) !== JSON.stringify(record))
-                throw new Error('mutation-qa-debt-conflict');
-        }
-        const directoryHandle = openSync(directory, 'r');
-        try {
-            fsyncSync(directoryHandle);
-        }
-        finally {
-            closeSync(directoryHandle);
-        }
-    }
-    finally {
-        if (lstatSync(temporary, { throwIfNoEntry: false }))
-            unlinkSync(temporary);
-    }
-    return record;
-}
-function recordMutationQaCheckpoint(projectRoot, baseRef, run) {
-    if (run.outcome !== 'verified' || !run.verdict
-        || run.verdict.planSha256 !== run.planSha256 || run.verdict.checkpointAccepted !== false) {
-        throw new Error('mutation-qa-checkpoint-verdict-unavailable');
-    }
-    const plan = planMutationQa(projectRoot, baseRef);
-    if (plan.outcome !== 'ready' || plan.planSha256 !== run.planSha256
-        || plan.headSha !== run.headSha)
-        throw new Error('mutation-qa-checkpoint-plan-drift');
-    const { root, directory } = context(projectRoot, true);
-    const payload = { schemaVersion: 1, kind: 'mutation-qa-checkpoint',
-        planSha256: plan.planSha256, headSha: plan.headSha, baseSha: plan.baseSha,
-        reportSha256: run.verdict.reportSha256, verdict: run.verdict.outcome,
-        mutationScore: run.verdict.mutationScore, checkpointAccepted: true,
-        qaPassed: run.verdict.outcome === 'passed', localOnly: true };
-    const record = Object.freeze({ ...payload, checksumSha256: createHash('sha256')
-            .update(`mutation-qa-checkpoint-v1\0${JSON.stringify(payload)}`).digest('hex') });
-    const target = join(directory, `${plan.planSha256}.json`);
-    if (lstatSync(target, { throwIfNoEntry: false })) {
-        const previous = checkedRecord(target);
-        if (JSON.stringify(previous) !== JSON.stringify(record)) {
-            throw new Error('mutation-qa-checkpoint-conflict');
-        }
-        return previous;
-    }
-    const temporary = join(directory, `checkpoint-${randomUUID()}.tmp`);
-    try {
-        const handle = openSync(temporary, 'wx', 0o600);
-        try {
-            writeFileSync(handle, `${JSON.stringify(record)}\n`);
-            fsyncSync(handle);
-        }
-        finally {
-            closeSync(handle);
-        }
-        if (planMutationQa(root, baseRef).planSha256 !== plan.planSha256) {
-            throw new Error('mutation-qa-checkpoint-plan-drift');
-        }
-        try {
-            linkSync(temporary, target);
-        }
-        catch (error) {
-            if (error.code !== 'EEXIST')
-                throw error;
-            const previous = checkedRecord(target);
-            if (JSON.stringify(previous) !== JSON.stringify(record)) {
-                throw new Error('mutation-qa-checkpoint-conflict');
-            }
-        }
-        const directoryHandle = openSync(directory, 'r');
-        try {
-            fsyncSync(directoryHandle);
-        }
-        finally {
-            closeSync(directoryHandle);
-        }
-    }
-    finally {
-        if (lstatSync(temporary, { throwIfNoEntry: false }))
-            unlinkSync(temporary);
-    }
-    return record;
-}
-/** An authorized root run is the only producer; skips never create a checkpoint. */
-export function runAndRecordMutationQa(projectRoot, baseRef, planSha256) {
-    const result = runMutationQa(projectRoot, baseRef, planSha256);
-    return result.outcome === 'verified'
-        ? { result, checkpoint: recordMutationQaCheckpoint(projectRoot, baseRef, result) }
-        : { result };
-}
-/** Revalidate the exact physical plan before projecting a private checkpoint. */
-export function readMutationQaCheckpoint(projectRoot, baseRef, planSha256) {
-    if (!/^[a-f0-9]{64}$/.test(planSha256))
-        throw new Error('mutation-qa-plan-digest-invalid');
-    const plan = planMutationQa(projectRoot, baseRef);
-    if (plan.planSha256 !== planSha256)
-        throw new Error('mutation-qa-checkpoint-plan-drift');
-    const { directory } = context(projectRoot, false);
-    const target = join(directory, `${planSha256}.json`);
-    if (!lstatSync(target, { throwIfNoEntry: false }))
-        return undefined;
-    const record = checkedRecord(target);
-    if (record.planSha256 !== planSha256 || record.headSha !== plan.headSha
-        || record.baseSha !== plan.baseSha)
-        throw new Error('mutation-qa-checkpoint-plan-drift');
-    return record;
-}
+import{createHash as b,randomUUID as J}from"node:crypto";import{closeSync as S,fsyncSync as w,lstatSync as h,mkdirSync as D,openSync as k,readFileSync as x,realpathSync as A,linkSync as I,unlinkSync as j,writeFileSync as P}from"node:fs";import{isAbsolute as F,join as y,resolve as q}from"node:path";import{mutationQaGit as g}from"./mutation-qa-git.js";import{planMutationQa as v}from"./mutation-qa.js";import{runMutationQa as H}from"./mutation-qa-run.js";function E(n,o){const e=q(n),r=g(e,["rev-parse","--show-toplevel"]).toString("utf8").trim(),t=g(e,["rev-parse","--git-common-dir"]).toString("utf8").trim(),a=F(t)?q(t):q(e,t);if(A(e)!==e||r!==e||A(a)!==a||h(a).isSymbolicLink()||h(a).uid!==process.getuid?.())throw new Error("mutation-qa-checkpoint-store-invalid");const i=y(a,"neocortex-mutation-qa");let c=!1;if(o&&!h(i,{throwIfNoEntry:!1}))try{D(i,{mode:448}),c=!0}catch(s){if(s.code!=="EEXIST")throw s}const d=h(i,{throwIfNoEntry:!1});if(d&&(!d.isDirectory()||d.isSymbolicLink()||d.uid!==process.getuid?.()||(d.mode&63)!==0))throw new Error("mutation-qa-checkpoint-store-invalid");if(c){const s=k(a,"r");try{w(s)}finally{S(s)}}return{root:e,directory:i}}function O(n){const o=h(n);if(!o.isFile()||o.isSymbolicLink()||o.uid!==process.getuid?.()||(o.mode&63)!==0||o.size<1||o.size>4096)throw new Error("mutation-qa-checkpoint-record-invalid");const e=x(n,"utf8");let r;try{r=JSON.parse(e)}catch{throw new Error("mutation-qa-checkpoint-record-invalid")}if(!r||typeof r!="object"||Array.isArray(r))throw new Error("mutation-qa-checkpoint-record-invalid");const t=r,{checksumSha256:a,...i}=t,c=b("sha256").update(`mutation-qa-checkpoint-v1\0${JSON.stringify(i)}`).digest("hex");if(Object.keys(t).sort().join(",")!==["schemaVersion","kind","planSha256","headSha","baseSha","reportSha256","verdict","mutationScore","checkpointAccepted","qaPassed","localOnly","checksumSha256"].sort().join(",")||t.schemaVersion!==1||t.kind!=="mutation-qa-checkpoint"||typeof t.planSha256!="string"||!/^[a-f0-9]{64}$/.test(t.planSha256)||typeof t.headSha!="string"||!/^[a-f0-9]{40,64}$/.test(t.headSha)||typeof t.baseSha!="string"||!/^[a-f0-9]{40,64}$/.test(t.baseSha)||typeof t.reportSha256!="string"||!/^[a-f0-9]{64}$/.test(t.reportSha256)||!["passed","warned","failed"].includes(String(t.verdict))||typeof t.mutationScore!="number"||!Number.isFinite(t.mutationScore)||t.mutationScore<0||t.mutationScore>100||t.checkpointAccepted!==!0||t.qaPassed!==(t.verdict==="passed")||t.localOnly!==!0||a!==c||e!==`${JSON.stringify(t)}
+`)throw new Error("mutation-qa-checkpoint-record-invalid");return t}function Q(n){const o=h(n);if(!o.isFile()||o.isSymbolicLink()||o.uid!==process.getuid?.()||(o.mode&63)!==0||o.size<1||o.size>4096)throw new Error("mutation-qa-debt-record-invalid");const e=x(n,"utf8");let r;try{r=JSON.parse(e)}catch{throw new Error("mutation-qa-debt-record-invalid")}if(!r||typeof r!="object"||Array.isArray(r))throw new Error("mutation-qa-debt-record-invalid");const t=r,{checksumSha256:a,...i}=t,c=b("sha256").update(`mutation-qa-debt-v1\0${JSON.stringify(i)}`).digest("hex");if(Object.keys(t).sort().join(",")!==["schemaVersion","kind","planSha256","headSha","status","reasonCode","runOutcome","owner","severity","publicSafe","localOnly","checksumSha256"].sort().join(",")||t.schemaVersion!==1||t.kind!=="mutation-qa-follow-up-debt"||typeof t.planSha256!="string"||!/^[a-f0-9]{64}$/.test(t.planSha256)||typeof t.headSha!="string"||!/^[a-f0-9]{40,64}$/.test(t.headSha)||!["warned","unobserved"].includes(String(t.status))||t.reasonCode!==(t.status==="warned"?"mutation-qa-warned":"mutation-qa-observation-missing")||!["not-run","skipped-no-files","skipped-stryker-missing","skipped-dependencies-unavailable","skipped-host-isolation-unavailable","skipped-stryker-error","verified"].includes(String(t.runOutcome))||t.owner!=="root-qa"||t.severity!==(t.status==="warned"?"P2":"P3")||t.publicSafe!==!0||t.localOnly!==!0||a!==c||e!==`${JSON.stringify(t)}
+`)throw new Error("mutation-qa-debt-record-invalid");return t}function B(n,o,e,r,t,a){const i=v(n,o);if(i.planSha256!==e)throw new Error("mutation-qa-debt-plan-drift");const c=V(n,o,e);if(r==="warned"&&(t!=="verified"||c?.verdict!=="warned"))throw new Error("mutation-qa-debt-run-invalid");if(r==="unobserved"&&(i.outcome!=="ready"||c||!["skipped-stryker-missing","skipped-dependencies-unavailable","skipped-stryker-error"].includes(t)))throw new Error("mutation-qa-debt-run-invalid");const{root:d,directory:s}=E(a??n,!0);if(a&&g(d,["rev-parse","--verify","HEAD"]).toString("utf8").trim()!==i.baseSha)throw new Error("mutation-qa-debt-root-drift");const l={schemaVersion:1,kind:"mutation-qa-follow-up-debt",planSha256:e,headSha:i.headSha,status:r,reasonCode:r==="warned"?"mutation-qa-warned":"mutation-qa-observation-missing",runOutcome:t,owner:"root-qa",severity:r==="warned"?"P2":"P3",publicSafe:!0,localOnly:!0},f=Object.freeze({...l,checksumSha256:b("sha256").update(`mutation-qa-debt-v1\0${JSON.stringify(l)}`).digest("hex")}),p=y(s,`debt-${e}.json`);if(h(p,{throwIfNoEntry:!1})){const m=Q(p);if(JSON.stringify(m)!==JSON.stringify(f))throw new Error("mutation-qa-debt-conflict");return m}const u=y(s,`debt-${J()}.tmp`);try{const m=k(u,"wx",384);try{P(m,`${JSON.stringify(f)}
+`),w(m)}finally{S(m)}if(v(n,o).planSha256!==e||a&&g(d,["rev-parse","--verify","HEAD"]).toString("utf8").trim()!==i.baseSha)throw new Error("mutation-qa-debt-plan-drift");try{I(u,p)}catch($){if($.code!=="EEXIST")throw $;const z=Q(p);if(JSON.stringify(z)!==JSON.stringify(f))throw new Error("mutation-qa-debt-conflict")}const N=k(s,"r");try{w(N)}finally{S(N)}}finally{h(u,{throwIfNoEntry:!1})&&j(u)}return f}function M(n,o,e){if(e.outcome!=="verified"||!e.verdict||e.verdict.planSha256!==e.planSha256||e.verdict.checkpointAccepted!==!1)throw new Error("mutation-qa-checkpoint-verdict-unavailable");const r=v(n,o);if(r.outcome!=="ready"||r.planSha256!==e.planSha256||r.headSha!==e.headSha)throw new Error("mutation-qa-checkpoint-plan-drift");const{root:t,directory:a}=E(n,!0),i={schemaVersion:1,kind:"mutation-qa-checkpoint",planSha256:r.planSha256,headSha:r.headSha,baseSha:r.baseSha,reportSha256:e.verdict.reportSha256,verdict:e.verdict.outcome,mutationScore:e.verdict.mutationScore,checkpointAccepted:!0,qaPassed:e.verdict.outcome==="passed",localOnly:!0},c=Object.freeze({...i,checksumSha256:b("sha256").update(`mutation-qa-checkpoint-v1\0${JSON.stringify(i)}`).digest("hex")}),d=y(a,`${r.planSha256}.json`);if(h(d,{throwIfNoEntry:!1})){const l=O(d);if(JSON.stringify(l)!==JSON.stringify(c))throw new Error("mutation-qa-checkpoint-conflict");return l}const s=y(a,`checkpoint-${J()}.tmp`);try{const l=k(s,"wx",384);try{P(l,`${JSON.stringify(c)}
+`),w(l)}finally{S(l)}if(v(t,o).planSha256!==r.planSha256)throw new Error("mutation-qa-checkpoint-plan-drift");try{I(s,d)}catch(p){if(p.code!=="EEXIST")throw p;const u=O(d);if(JSON.stringify(u)!==JSON.stringify(c))throw new Error("mutation-qa-checkpoint-conflict")}const f=k(a,"r");try{w(f)}finally{S(f)}}finally{h(s,{throwIfNoEntry:!1})&&j(s)}return c}function K(n,o,e){const r=H(n,o,e);return r.outcome==="verified"?{result:r,checkpoint:M(n,o,r)}:{result:r}}function V(n,o,e){if(!/^[a-f0-9]{64}$/.test(e))throw new Error("mutation-qa-plan-digest-invalid");const r=v(n,o);if(r.planSha256!==e)throw new Error("mutation-qa-checkpoint-plan-drift");const{directory:t}=E(n,!1),a=y(t,`${e}.json`);if(!h(a,{throwIfNoEntry:!1}))return;const i=O(a);if(i.planSha256!==e||i.headSha!==r.headSha||i.baseSha!==r.baseSha)throw new Error("mutation-qa-checkpoint-plan-drift");return i}export{V as readMutationQaCheckpoint,B as recordMutationQaFollowUpDebt,K as runAndRecordMutationQa};

package/packages/client/dist/commands/mutation-qa-gate.js

@@ -1,54 +1 @@
-/** Root-only classification of a physically bound mutation observation. */
-import { readMutationQaCheckpoint, recordMutationQaFollowUpDebt, runAndRecordMutationQa } from './mutation-qa-checkpoint.js';
-import { planMutationQa } from './mutation-qa.js';
-/** A skip is never a passing verdict; the caller must persist required debt separately. */
-export function classifyMutationQaGate(projectRoot, baseRef, expectedPlanSha256) {
-    const plan = planMutationQa(projectRoot, baseRef);
-    if (plan.planSha256 !== expectedPlanSha256)
-        throw new Error('mutation-qa-gate-plan-drift');
-    const checkpoint = readMutationQaCheckpoint(projectRoot, baseRef, expectedPlanSha256);
-    if (planMutationQa(projectRoot, baseRef).planSha256 !== plan.planSha256) {
-        throw new Error('mutation-qa-gate-plan-drift');
-    }
-    const status = checkpoint?.verdict ?? (plan.outcome === 'skipped-no-files'
-        ? 'not-applicable' : 'unobserved');
-    const reasonCode = status === 'passed' ? 'mutation-qa-passed'
-        : status === 'warned' ? 'mutation-qa-warned'
-            : status === 'failed' ? 'mutation-qa-failed'
-                : status === 'not-applicable' ? 'mutation-qa-no-eligible-files'
-                    : 'mutation-qa-observation-missing';
-    return Object.freeze({ schemaVersion: 1, kind: 'mutation-qa-gate-decision',
-        planSha256: plan.planSha256, headSha: plan.headSha, status, reasonCode,
-        checkpointAccepted: checkpoint !== undefined, qaPassed: status === 'passed',
-        blocksLocalQa: status === 'failed',
-        followUpDebtRequired: status === 'warned' || status === 'unobserved',
-        safeToContinueLocalQa: status === 'passed' || status === 'not-applicable',
-        publicSafe: true, localOnly: true });
-}
-/** One root transaction from a reviewed physical plan to verdict or durable debt. */
-export function executeMutationQaPlan(projectRoot, baseRef, expectedPlanSha256) {
-    const plan = planMutationQa(projectRoot, baseRef);
-    if (plan.planSha256 !== expectedPlanSha256)
-        throw new Error('mutation-qa-plan-drift');
-    const run = plan.outcome === 'ready'
-        ? runAndRecordMutationQa(projectRoot, baseRef, expectedPlanSha256)
-        : undefined;
-    if (run?.result.outcome === 'skipped-host-isolation-unavailable') {
-        throw new Error('mutation-qa-host-isolation-unavailable');
-    }
-    const decision = classifyMutationQaGate(projectRoot, baseRef, expectedPlanSha256);
-    const followUpDebt = decision.followUpDebtRequired
-        ? recordMutationQaFollowUpDebt(projectRoot, baseRef, expectedPlanSha256, decision.status, run?.result.outcome ?? 'not-run')
-        : undefined;
-    if (planMutationQa(projectRoot, baseRef).planSha256 !== expectedPlanSha256) {
-        throw new Error('mutation-qa-root-execution-drift');
-    }
-    return Object.freeze({ schemaVersion: 1, kind: 'mutation-qa-root-execution',
-        planSha256: expectedPlanSha256, headSha: plan.headSha,
-        runOutcome: run?.result.outcome ?? 'not-run', decision,
-        ...(run?.checkpoint ? { checkpoint: run.checkpoint } : {}),
-        ...(followUpDebt ? { followUpDebt } : {}),
-        continuationAuthorized: decision.safeToContinueLocalQa
-            || (!!followUpDebt && !decision.blocksLocalQa),
-        publicSafe: true, localOnly: true });
-}
+import{readMutationQaCheckpoint as l,recordMutationQaFollowUpDebt as s,runAndRecordMutationQa as c}from"./mutation-qa-checkpoint.js";import{planMutationQa as u}from"./mutation-qa.js";function d(n,t,o){const i=u(n,t);if(i.planSha256!==o)throw new Error("mutation-qa-gate-plan-drift");const e=l(n,t,o);if(u(n,t).planSha256!==i.planSha256)throw new Error("mutation-qa-gate-plan-drift");const a=e?.verdict??(i.outcome==="skipped-no-files"?"not-applicable":"unobserved"),r=a==="passed"?"mutation-qa-passed":a==="warned"?"mutation-qa-warned":a==="failed"?"mutation-qa-failed":a==="not-applicable"?"mutation-qa-no-eligible-files":"mutation-qa-observation-missing";return Object.freeze({schemaVersion:1,kind:"mutation-qa-gate-decision",planSha256:i.planSha256,headSha:i.headSha,status:a,reasonCode:r,checkpointAccepted:e!==void 0,qaPassed:a==="passed",blocksLocalQa:a==="failed",followUpDebtRequired:a==="warned"||a==="unobserved",safeToContinueLocalQa:a==="passed"||a==="not-applicable",publicSafe:!0,localOnly:!0})}function f(n,t,o){const i=u(n,t);if(i.planSha256!==o)throw new Error("mutation-qa-plan-drift");const e=i.outcome==="ready"?c(n,t,o):void 0;if(e?.result.outcome==="skipped-host-isolation-unavailable")throw new Error("mutation-qa-host-isolation-unavailable");const a=d(n,t,o),r=a.followUpDebtRequired?s(n,t,o,a.status,e?.result.outcome??"not-run"):void 0;if(u(n,t).planSha256!==o)throw new Error("mutation-qa-root-execution-drift");return Object.freeze({schemaVersion:1,kind:"mutation-qa-root-execution",planSha256:o,headSha:i.headSha,runOutcome:e?.result.outcome??"not-run",decision:a,...e?.checkpoint?{checkpoint:e.checkpoint}:{},...r?{followUpDebt:r}:{},continuationAuthorized:a.safeToContinueLocalQa||!!r&&!a.blocksLocalQa,publicSafe:!0,localOnly:!0})}export{d as classifyMutationQaGate,f as executeMutationQaPlan};

package/packages/client/dist/commands/mutation-qa-git.js

@@ -1,41 +1 @@
-/** Closed host Git boundary for root-owned mutation QA planning and clone setup. */
-import { execFileSync } from 'node:child_process';
-import { existsSync, lstatSync, realpathSync } from 'node:fs';
-import { isAbsolute, join } from 'node:path';
-function trustedGit() {
-    for (const directory of (process.env.PATH ?? '').split(':')) {
-        if (!isAbsolute(directory))
-            continue;
-        const candidate = join(directory, 'git');
-        if (!existsSync(candidate))
-            continue;
-        try {
-            const resolved = realpathSync(candidate);
-            if ((resolved.startsWith('/usr/') || resolved.startsWith('/home/linuxbrew/.linuxbrew/'))
-                && lstatSync(resolved).isFile())
-                return resolved;
-        }
-        catch { /* The first matching Git on PATH is untrusted. */ }
-        break;
-    }
-    throw new Error('mutation-qa-git-untrusted');
-}
-/** Exclude ambient Git configuration and executable shadowing; disable local hook/fsmonitor execution. */
-export function mutationQaGit(root, args) {
-    return execFileSync(trustedGit(), [
-        '-c', 'core.fsmonitor=false', '-c', 'core.hooksPath=/dev/null',
-        '-c', 'protocol.ext.allow=never', ...args,
-    ], {
-        cwd: root,
-        env: {
-            PATH: '/usr/bin:/bin',
-            GIT_CONFIG_NOSYSTEM: '1',
-            GIT_CONFIG_GLOBAL: '/dev/null',
-            GIT_CONFIG_SYSTEM: '/dev/null',
-            GIT_TERMINAL_PROMPT: '0',
-            GIT_OPTIONAL_LOCKS: '0',
-            GIT_LFS_SKIP_SMUDGE: '1',
-        },
-        stdio: ['ignore', 'pipe', 'pipe'], timeout: 15_000, maxBuffer: 8 * 1024 * 1024,
-    });
-}
+import{execFileSync as r}from"node:child_process";import{existsSync as i,lstatSync as n,realpathSync as s}from"node:fs";import{isAbsolute as c,join as u}from"node:path";function l(){for(const t of(process.env.PATH??"").split(":")){if(!c(t))continue;const e=u(t,"git");if(i(e)){try{const o=s(e);if((o.startsWith("/usr/")||o.startsWith("/home/linuxbrew/.linuxbrew/"))&&n(o).isFile())return o}catch{}break}}throw new Error("mutation-qa-git-untrusted")}function G(t,e){return r(l(),["-c","core.fsmonitor=false","-c","core.hooksPath=/dev/null","-c","protocol.ext.allow=never",...e],{cwd:t,env:{PATH:"/usr/bin:/bin",GIT_CONFIG_NOSYSTEM:"1",GIT_CONFIG_GLOBAL:"/dev/null",GIT_CONFIG_SYSTEM:"/dev/null",GIT_TERMINAL_PROMPT:"0",GIT_OPTIONAL_LOCKS:"0",GIT_LFS_SKIP_SMUDGE:"1"},stdio:["ignore","pipe","pipe"],timeout:15e3,maxBuffer:8*1024*1024})}export{G as mutationQaGit};

package/packages/client/dist/commands/mutation-qa-policy.js

@@ -1,102 +1 @@
-/** Closed local mutation policy projection; never falls back from malformed project policy. */
-import { createHash } from 'node:crypto';
-import { lstatSync, readFileSync, realpathSync } from 'node:fs';
-import { join } from 'node:path';
-const DEFAULT_FIELDS = Object.freeze({ schema_version: 1, default_threshold: 75,
-    block_threshold: 50,
-    exclude_paths: ['**/*.test.ts', '**/*.spec.ts', '**/__tests__/**', '**/migrations/**', '**/*.d.ts'],
-    per_area_threshold: { domain: 90, infrastructure: 60 } });
-const MAX_POLICY_BYTES = 16 * 1024;
-function validScore(value) {
-    return typeof value === 'number' && Number.isFinite(value) && value >= 0 && value <= 100;
-}
-function globRegex(pattern) {
-    if (pattern.length === 0 || pattern.length > 240 || pattern.startsWith('/')
-        || pattern.includes('..') || pattern.includes('//')
-        || !/^[A-Za-z0-9_./*?-]+$/.test(pattern)) {
-        throw new Error('mutation-qa-policy-pattern-invalid');
-    }
-    let expression = '^';
-    for (let index = 0; index < pattern.length; index++) {
-        const current = pattern[index];
-        if (current === '*') {
-            if (pattern[index + 1] === '*') {
-                if (pattern[index + 2] === '/') {
-                    expression += '(?:.*/)?';
-                    index += 2;
-                }
-                else {
-                    expression += '.*';
-                    index++;
-                }
-            }
-            else
-                expression += '[^/]*';
-        }
-        else if (current === '?')
-            expression += '[^/]';
-        else if (current === '/')
-            expression += '/';
-        else
-            expression += current.replace(/[.*+?^${}()|[\]\\]/g, '\\$&');
-    }
-    return new RegExp(`${expression}$`);
-}
-export function policyExcludesPath(policy, path) {
-    return policy.excludePaths.some((pattern) => globRegex(pattern).test(path));
-}
-/** Accept a bounded subset of the published policy schema, failing closed on unknown semantics. */
-export function loadMutationQaPolicy(projectRoot) {
-    const path = join(projectRoot, '.neocortex', 'mutation-policy.json');
-    let source = 'default';
-    let raw = Buffer.from(JSON.stringify(DEFAULT_FIELDS));
-    const stat = lstatSync(path, { throwIfNoEntry: false });
-    if (stat) {
-        if (realpathSync(path) !== path)
-            throw new Error('mutation-qa-policy-path-unsafe');
-        if (!stat.isFile() || stat.size === 0 || stat.size > MAX_POLICY_BYTES) {
-            throw new Error('mutation-qa-policy-size-invalid');
-        }
-        raw = readFileSync(path);
-        if (raw.byteLength === 0 || raw.byteLength > MAX_POLICY_BYTES) {
-            throw new Error('mutation-qa-policy-size-invalid');
-        }
-        source = 'project';
-    }
-    let parsed;
-    try {
-        parsed = JSON.parse(raw.toString('utf8').replace(/^\uFEFF/, ''));
-    }
-    catch {
-        throw new Error('mutation-qa-policy-invalid');
-    }
-    if (!parsed || typeof parsed !== 'object' || Array.isArray(parsed)) {
-        throw new Error('mutation-qa-policy-invalid');
-    }
-    const policy = parsed;
-    const allowed = new Set(['$schema', '_comment', 'schema_version', 'default_threshold',
-        'block_threshold', 'exclude_paths', 'per_area_threshold']);
-    if (Object.keys(policy).some((key) => !allowed.has(key)) || policy.schema_version !== 1
-        || !validScore(policy.default_threshold) || !validScore(policy.block_threshold)
-        || policy.block_threshold > policy.default_threshold
-        || !Array.isArray(policy.exclude_paths) || policy.exclude_paths.length > 32
-        || policy.exclude_paths.some((entry) => typeof entry !== 'string')) {
-        throw new Error('mutation-qa-policy-invalid');
-    }
-    const exclusions = policy.exclude_paths.map((entry) => {
-        globRegex(entry);
-        return entry;
-    });
-    const areas = policy.per_area_threshold ?? {};
-    if (!areas || typeof areas !== 'object' || Array.isArray(areas)
-        || Object.keys(areas).length > 32
-        || Object.entries(areas).some(([key, value]) => !/^[a-z][a-z0-9-]{0,63}$/.test(key)
-            || !validScore(value)))
-        throw new Error('mutation-qa-policy-invalid');
-    const perAreaThreshold = Object.freeze({ ...areas });
-    return Object.freeze({ schemaVersion: 1, source,
-        sha256: createHash('sha256').update(raw).digest('hex'),
-        thresholds: Object.freeze({ defaultThreshold: policy.default_threshold,
-            blockThreshold: policy.block_threshold, perAreaThreshold }),
-        excludePaths: Object.freeze(exclusions), });
-}
+import{createHash as m}from"node:crypto";import{lstatSync as y,readFileSync as b,realpathSync as w}from"node:fs";import{join as x}from"node:path";const g=Object.freeze({schema_version:1,default_threshold:75,block_threshold:50,exclude_paths:["**/*.test.ts","**/*.spec.ts","**/__tests__/**","**/migrations/**","**/*.d.ts"],per_area_threshold:{domain:90,infrastructure:60}}),h=16*1024;function c(e){return typeof e=="number"&&Number.isFinite(e)&&e>=0&&e<=100}function d(e){if(e.length===0||e.length>240||e.startsWith("/")||e.includes("..")||e.includes("//")||!/^[A-Za-z0-9_./*?-]+$/.test(e))throw new Error("mutation-qa-policy-pattern-invalid");let t="^";for(let o=0;o<e.length;o++){const s=e[o];s==="*"?e[o+1]==="*"?e[o+2]==="/"?(t+="(?:.*/)?",o+=2):(t+=".*",o++):t+="[^/]*":s==="?"?t+="[^/]":s==="/"?t+="/":t+=s.replace(/[.*+?^${}()|[\]\\]/g,"\\$&")}return new RegExp(`${t}$`)}function O(e,t){return e.excludePaths.some(o=>d(o).test(t))}function A(e){const t=x(e,".neocortex","mutation-policy.json");let o="default",s=Buffer.from(JSON.stringify(g));const n=y(t,{throwIfNoEntry:!1});if(n){if(w(t)!==t)throw new Error("mutation-qa-policy-path-unsafe");if(!n.isFile()||n.size===0||n.size>h)throw new Error("mutation-qa-policy-size-invalid");if(s=b(t),s.byteLength===0||s.byteLength>h)throw new Error("mutation-qa-policy-size-invalid");o="project"}let a;try{a=JSON.parse(s.toString("utf8").replace(/^\uFEFF/,""))}catch{throw new Error("mutation-qa-policy-invalid")}if(!a||typeof a!="object"||Array.isArray(a))throw new Error("mutation-qa-policy-invalid");const r=a,f=new Set(["$schema","_comment","schema_version","default_threshold","block_threshold","exclude_paths","per_area_threshold"]);if(Object.keys(r).some(i=>!f.has(i))||r.schema_version!==1||!c(r.default_threshold)||!c(r.block_threshold)||r.block_threshold>r.default_threshold||!Array.isArray(r.exclude_paths)||r.exclude_paths.length>32||r.exclude_paths.some(i=>typeof i!="string"))throw new Error("mutation-qa-policy-invalid");const u=r.exclude_paths.map(i=>(d(i),i)),l=r.per_area_threshold??{};if(!l||typeof l!="object"||Array.isArray(l)||Object.keys(l).length>32||Object.entries(l).some(([i,_])=>!/^[a-z][a-z0-9-]{0,63}$/.test(i)||!c(_)))throw new Error("mutation-qa-policy-invalid");const p=Object.freeze({...l});return Object.freeze({schemaVersion:1,source:o,sha256:m("sha256").update(s).digest("hex"),thresholds:Object.freeze({defaultThreshold:r.default_threshold,blockThreshold:r.block_threshold,perAreaThreshold:p}),excludePaths:Object.freeze(u)})}export{A as loadMutationQaPolicy,O as policyExcludesPath};